access: forgetting and revoking as the API lets

Two writes the API lets a user make were refused by the rules:

* DELETE /peers/{pk}, with write on _continuum/forgotten alone, writes
  the forget record and removes the member's entry in one change; the
  rules wanted write on the entry. Removing an entry is now also taken
  in a change forgetting that member, from a user who may forget it.
* DELETE /admin/users/{name}/tokens by a user who manages users writes
  _continuum/logouts/<name>; the rules wanted write there. One who may
  write _continuum/users may now write anyone's logouts entry.

Review finding 3 (DELETE /peers, revoking tokens).

0 files changed, 0 insertions, 0 deletions