Principals from settings not taken into account when hiding permissions

Since #837, the permissions are empty if the user has no `write` permission.

But the permissions from settings are not taken into account.

For example, with this conf:

``` ini
# kinto.ini
kinto.bucket_create_principals = system.Authenticated
kinto.bucket_write_principals = system.Authenticated
```

Someone creates a bucket:

``` http
$ http PUT :8888/v1/buckets/her --auth token:alice
HTTP/1.1 201 Created
Access-Control-Expose-Headers: Retry-After, Content-Length, Alert, Backoff
Content-Length: 154
Content-Type: application/json; charset=UTF-8
Date: Fri, 28 Oct 2016 15:27:25 GMT
Etag: "1477668445792"
Last-Modified: Fri, 28 Oct 2016 15:27:25 GMT
Server: waitress

{
"data": {
"id": "her",
"last_modified": 1477668445792
},
"permissions": {
"write": [
"basicauth:a06c2d0d82a192b5afab7695eb1159b75dd5a7732caa442db624e5c7c334bcb6"
]
}
}
```

Because of the setting, every can write. However:

``` http
$ http GET :8888/v1/buckets/her --auth token:bob
HTTP/1.1 200 OK
Access-Control-Expose-Headers: Content-Length, Expires, Alert, Retry-After, Last-Modified, ETag, Pragma, Cache-Control, Backoff
Cache-Control: no-cache, no-store
Content-Length: 68
Content-Type: application/json; charset=UTF-8
Date: Fri, 28 Oct 2016 15:27:35 GMT
Etag: "1477668445792"
Last-Modified: Fri, 28 Oct 2016 15:27:25 GMT
Server: waitress

{
"data": {
"id": "her",
"last_modified": 1477668445792
},
"permissions": {}
}

```

Once bob touches the object, a `write` permission is added, and he can see the permissions:

``` http
$ http PUT :8888/v1/buckets/her --auth token:bob
```

Then only he can see them:

``` http
$ http GET :8888/v1/buckets/her --auth token:bob
HTTP/1.1 200 OK
Access-Control-Expose-Headers: Content-Length, Expires, Alert, Retry-After, Last-Modified, ETag, Pragma, Cache-Control, Backoff
Cache-Control: no-cache, no-store
Content-Length: 231
Content-Type: application/json; charset=UTF-8
Date: Fri, 28 Oct 2016 15:32:24 GMT
Etag: "1477668710206"
Last-Modified: Fri, 28 Oct 2016 15:31:50 GMT
Server: waitress

{
"data": {
"id": "her",
"last_modified": 1477668710206
},
"permissions": {
"write": [
"basicauth:a06c2d0d82a192b5afab7695eb1159b75dd5a7732caa442db624e5c7c334bcb6",
"basicauth:5b3d8c06ef1c659316610d3be9cf5147ca56906d9dd1d6e1d678176843da40e6"
]
}
}

```

The principals specified in the settings must be taken into account when hiding permissions.

Related #893 #837 #350

Reproduce the issue using the kinto.ini settings kinto.bucket_create_principals and kinto.bucket_write_principals, then compare the bucket GET responses before and after Bob writes to the bucket. Trace the permission-hiding behavior for the bucket GET endpoint and add coverage showing that configured principals are considered. Done means Bob can see the applicable write permission without first modifying the object.

Written by the indexing model from the issue text.