Fix demo data
Improve permission rules

Permissions without condition on an object
should get preference over wild card permission.

This allows easy refinement of permission rules.

Fixes RM-2803