Partially address #7385

Here is one option.

This does not fully work on Windows - ACLs are ignored - but is no worse than the current situation.
Why the special case for directories? Doesn't `access` work on any file?