Small fixes for geonode_authorize_layer bugs.

* Fix a bug that prevented anonymous roles from propagating up to registered users.
* Move the generic read-only logic to come after all read-write lookups.
* Use group-* for group permission hits vs gr-* which is also used for generic roles.