Per role setting should override control access setting

Issue Summary

"Authenticated user" role can be a large set including many roles. They are treated as peers, but in fact a "MyRole" role is a subset of "Authenticated user".

Now User Protect check the larger set ("Authenticated user") before "MyRole" settings. In this way, if an Authenticated user is allowed to change e.g. his/her password, but "MyRole" haven't that access, a MyRole + Authenticated user can change his/her password.

This patch made against 5.x-1.3 version switch the two controls on function userprotect_get_user_protection to make subset settings effective.