From #239942: Merge file download permissions with asset usage permissions

Split off of http://drupal.org/node/239942.

To recap, if a user doesn't have permission to download a file asset (because of private download method), they should not be able to place that asset into the content no matter what their asset permissions are.