[fix] Subtraction is never quite as effective in reverse.

lib/kohai.js

@@ -138,15 +138,13 @@ Kohai.prototype.checkAuth = function (data) {
   var self = this,
       access = self.config.get('access'),
       inherit = false;
-
   if (data.admin || data.employee || data.friend) {
     // If the incoming message has a rank field already,
     // this message is likely hax and can GTFO.
     return false; 
   }
-
   Object.keys(access).sort(function (a, b) {
-    return rankOf(b) - rankOf(a);
+    return rankOf(a) - rankOf(b);
   }).forEach(function (level) { 
     if (inherit) { 
       data[level] = true;
@@ -159,18 +157,15 @@ Kohai.prototype.checkAuth = function (data) {
       }
     });
   });
-
   function rankOf (x) { 
     return { 
       admin : 0, 
       employee : 1, 
       friend : 2 
     }[x] 
   }
-
   if (data.to === self.ircNick) { return self._dispatchPM(data) }
   return self._dispatcher(data);
-
 }