Fix bug 10196 - RW Deny for a specific user is not overriding RW Allow for a group.