Improve forbidden checks

New functions were created to check 'allowed' access because the previous design
was checking after changes were possibly made.

Changed the unit test to use an already created user to simulate the original
error that was reported.

Change-Id: I9f7e56a5afd9624070fffef6672ef88cd549f210
Closes-Bug: #1174451
Merge "Improve forbidden checks"