Permissions not set as expected

[Jotschi]

1. Set permission on anonymous role:

* Preparing request to http://127.0.0.1:8080/api/v1/roles/a8488d8b47ae4bf6888d8b47aeebf611/permissions/users
* Using libcurl/7.54.0 LibreSSL/2.6.4 zlib/1.2.11 nghttp2/1.24.1
* Enable automatic URL encoding
* Enable SSL validation
* Enable cookie sending with jar of 1 cookie
* Found bundle for host 127.0.0.1: 0x7fcfa10f9600 [can pipeline]
* Re-using existing connection! (#17) with host 127.0.0.1
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#17)
> POST /api/v1/roles/a8488d8b47ae4bf6888d8b47aeebf611/permissions/users HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: insomnia/6.2.0
> Cookie: mesh.token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyVXVpZCI6Ijg5ZDA5ZDJiMjkxMDQ4NDE5MDlkMmIyOTEwOTg0MTk5IiwiaWF0IjoxNTQyMzk3ODI1LCJleHAiOjE1NDI0MDE0MjV9.3_Sqf-yphAu4a2AH6Jw39R60D5p8JMNJtFEPws1m0uQ
> Content-Type: application/json
> Accept: */*
> Content-Length: 185
| {
|     "permissions" : {
|     "create" : true,
|     "read" : false,
|     "update" : false,
|     "delete" : false,
|     "publish" : false,
|     "readPublished" : false
|   },
|   "recursive" : false
| }
* upload completely sent off: 185 out of 185 bytes
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=utf-8
< Cache-Control: no-cache
< Content-Length: 58
* Replaced cookie mesh.token="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyVXVpZCI6Ijg5ZDA5ZDJiMjkxMDQ4NDE5MDlkMmIyOTEwOTg0MTk5IiwiaWF0IjoxNTQyMzk3ODY5LCJleHAiOjE1NDI0MDE0Njl9.qfhi9t4kJUM9tFlAWirtNh-PPxaOwkLXtdmQi7_D7E0" for domain 127.0.0.1, path /, expire 1542401469
< Set-Cookie: mesh.token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyVXVpZCI6Ijg5ZDA5ZDJiMjkxMDQ4NDE5MDlkMmIyOTEwOTg0MTk5IiwiaWF0IjoxNTQyMzk3ODY5LCJleHAiOjE1NDI0MDE0Njl9.qfhi9t4kJUM9tFlAWirtNh-PPxaOwkLXtdmQi7_D7E0; Max-Age=3600; Expires=Fri, 16 Nov 2018 20:51:09 GMT; Path=/

* Received 58 B chunk
* Connection #17 to host 127.0.0.1 left intact
* Saved 1 cookie

2. Read permissions on role

* Preparing request to http://127.0.0.1:8080/api/v1/roles/a8488d8b47ae4bf6888d8b47aeebf611/permissions/users
* Using libcurl/7.54.0 LibreSSL/2.6.4 zlib/1.2.11 nghttp2/1.24.1
* Enable automatic URL encoding
* Enable SSL validation
* Enable cookie sending with jar of 1 cookie
* Found bundle for host 127.0.0.1: 0x7fcfa10f9600 [can pipeline]
* Re-using existing connection! (#17) with host 127.0.0.1
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#17)
> GET /api/v1/roles/a8488d8b47ae4bf6888d8b47aeebf611/permissions/users HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: insomnia/6.2.0
> Cookie: mesh.token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyVXVpZCI6Ijg5ZDA5ZDJiMjkxMDQ4NDE5MDlkMmIyOTEwOTg0MTk5IiwiaWF0IjoxNTQyMzk3OTI2LCJleHAiOjE1NDI0MDE1MjZ9.MWHcOmA8pWt_cL1QDq52eROqbDnr_603IVRZUqehsu0
> Accept: */*
< HTTP/1.1 200 OK
< Content-Type: application/json; charset=utf-8
< Cache-Control: no-cache
< Content-Length: 126
* Replaced cookie mesh.token="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyVXVpZCI6Ijg5ZDA5ZDJiMjkxMDQ4NDE5MDlkMmIyOTEwOTg0MTk5IiwiaWF0IjoxNTQyMzk3OTQwLCJleHAiOjE1NDI0MDE1NDB9.xUoQWNaG8WUrwUD8bTh8Ktzh-h0Dx4dCcS2Vh3EFfvI" for domain 127.0.0.1, path /, expire 1542401540
< Set-Cookie: mesh.token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyVXVpZCI6Ijg5ZDA5ZDJiMjkxMDQ4NDE5MDlkMmIyOTEwOTg0MTk5IiwiaWF0IjoxNTQyMzk3OTQwLCJleHAiOjE1NDI0MDE1NDB9.xUoQWNaG8WUrwUD8bTh8Ktzh-h0Dx4dCcS2Vh3EFfvI; Max-Age=3600; Expires=Fri, 16 Nov 2018 20:52:20 GMT; Path=/

* Received 126 B chunk
* Connection #17 to host 127.0.0.1 left intact
* Saved 1 cookie

Result:

{
  "create": true,
  "read": true,
  "update": false,
  "delete": false,
  "publish": false,
  "readPublished": false
}