If one of the user's groups had denied them access, but
this group grants them access, prefer the grant over
the denial. We have to break the tie somehow and we
prefer being \"more open\" to being \"more closed\".
