HDFS-4685-WIP: correct logic for determining new permissions.
HDFS-4685-WIP: simplify removeAcl once again.