Bugfix. Private access match moved to query.
Sync applyDefaultAccess with setRole.

For permissions, when access is private, maintainers and admins should
also be added to read access list so that if access is changed to
public and then their maintainer or admin permission is revoked, they
still retain read access if document is after all that switched back to
private access. We have this logic in applyDefaultAccess and setRole
and they should match.