Folder create authz improvements - review followup

canManageAny returns true if the current principal id is in there
Expanded tests