Fix access

[chripo]

under certain conditions it was possible to pass the final access control if-clause.
the master branch grants access if:

if ((read_allowed_items or write_allowed_items)
        and (not user or auth.is_authenticated(user, password))) or \
        function == self.options or not items:
    # Collections found, or OPTIONS request, or no items at all

the easy-connect branch from pull request #95 extends it with:

        (is_authenticated and function == self.propfind) or \

the last or not items condition levers out the previous authentication and access control. that isn't that big secuity issue because in this case there are no collection and items at all. but "bad" and anonymous users could gather data and information which not destined for them.

the first commit (Fix access to collections) simplifies the if-clause to:

        is_valid_user = is_authenticated or not user
        ...
        if is_valid_user and ( \
                (read_allowed_items or write_allowed_items) or \
                (is_authenticated and function == self.propfind) or \
                function == self.options):

the second commit (Find collections if necessary) is an improvement, it gathers items for valid user only.

[liZe]

Merged too, now that #95 is merged.