Stricter effective settings

[kavics]

Base expectation: do not serve any values from invisible settings. Create the following structure:

Root
    Content
        Settings
            Sensitive.settings: {P2}
        Groups
            Sensitive_Readers: Members: U1
        WS1
            Settings
                Sensitive.settings {P3}
            Groups
                Sensitive_Readers: (empty)
            WS2
                Settings
                    Sensitive.settings: {P4}
                Groups
                    Sensitive_Readers: Members: U1
                WS3
    System
        Settings
            Sensitive.settings: {P1}

Detailed expectations: If U1:denied on System/Settings/sensitive.settings, the responses of the getting "Sensitive" settings will be the followings:	Content	Response
/Root	{}
/Root/Content	{P2}
/Root/Content/WS1	{P2}
/Root/Content/WS1/WS2	{P2,P4}
/Root/Content/WS1/WS2/WS3	{P2,P4}

If U1:allowed on System/Settings/sensitive.settings, the table is changed to:	Content	Response
/Root	{P1}
/Root/Content	{P1,P2}
/Root/Content/WS1	{P1,P2}
/Root/Content/WS1/WS2	{P1,P2,P4}
/Root/Content/WS1/WS2/WS3	{P1,P2,P4}