MWS: Newly created users can access resources

[Jermolene]

Steps to reproduce:

1. Start with a fresh install of MWS
2. Run npm install and npm start
3. Visit http://127.0.0.1:8080/ in a browser
4. Click the button "Add Admin Account"
5. Enter suitable details for an admin account and click "Add User"
6. Choose "Manage Users" and then add the details of a new secondary user account
7. Click the home button
8. Choose "Manage Roles" and create a new role called OPERATOR
9. Return to manage users and assign the secondary user to the role OPERATOR
10. In a different browser, visit http://127.0.0.1:8080/ and login as the secondary user
11. Attempt to access a wiki, and observe that access is unexpectedly granted. I would have expected that a new user in a new role who has not been assigned any resources would not be granted read access to wikis/bags

cc @webplusai

[Jermolene]

Tests were performed with the commit ddfc8c4

[pmario]

I think we need to discuss these behaviours in more details first, before we start to "finalize" the ACL rules.

Need to think a bit more.