Authenticated user role should not override settings of more specific roles

All created roles inherit the authenticated user role. Therefore, this role is always present (except for anonymous users) and should not override settings for created roles if they have settings. If they don't have settings, use the settings defined for the authenticated user role.

Also avoid doing this calculation when the user has just one role or when the user does have the authenticated user role but this role does not have permissions to attach files (as it would be removed anyway).