Recipe ACL seems to inherit bag ACL setting. IMO that's wrong

- I do have 2 users: **aaa** and **bbb**
- aaa creates a bag: **bag-a** 
- aaa creates a recipe: **recipe-a**, which lists bag-a ... without any extra settings
- user aaa sets ACL for bag-a to USER : READ

-------

User bbb logs in

- User bbb sees the Recipe -> BUG
- and the bag -> OK

