3.0: The option `permissions: false` doesn't work for insert operations

## To Reproduce

Add the following module in a working instance of Apostrophe 3 and start the project:

```js
// module/example-module/index.js
module.exports = {
extend: '@apostrophecms/piece-type',
async init (self) {
const req = self.apos.task.getAnonReq()
await self.insert(req, { title: 'Testing' }, { permissions: false })
}
}
```
## Expected behavior

The piece should be saved while passing an anonymous request object when `permissions` is set to `false`.

## Describe the bug

The error `forbidden` is thrown.

```
forbidden: forbidden
at Object.error (/app/node_modules/apostrophe/modules/@apostrophecms/error/index.js:29:23)
at Object.testInsertPermissions (/app/node_modules/apostrophe/modules/@apostrophecms/doc/index.js:546:29)
at Object.testPermissionsAndAddIdAndCreatedAt (/app/node_modules/apostrophe/modules/@apostrophecms/doc/index.js:83:16)
at Object.emit (/app/node_modules/apostrophe/modules/@apostrophecms/module/lib/events.js:40:22)
at processTicksAndRejections (internal/process/task_queues.js:93:5)
at async Object.insert (/app/node_modules/apostrophe/modules/@apostrophecms/doc/index.js:359:9) {
data: null,
aposError: true
}
```

## Details

**Version of Apostrophe:** 3.0.0-alpha.3

**Additional context:**
My actual use case is inserting a new piece when the user call a custom API route, so the `req` object I receive is an anonymous request that went through express middlewares. However I reproduce the same behavior with the fake request object returned by `self.apos.task.getAnonReq()`, which is handy to reproduce the bug.

As a workaround, I'm using `self.apos.task.getReq()` instead of the anonymous `req` object whenever I need to insert a piece in this context.

Side note: the option do work for at least the `self.update()` method.

Start with module/example-module/index.js and reproduce the issue using self.apos.task.getAnonReq() and self.insert(..., { permissions: false }). Then inspect the insert path and testInsertPermissions in @apostrophecms/doc/index.js, where the stack trace shows the forbidden error. Done means an anonymous request can insert a piece with permissions set to false, while the existing update behavior remains intact.

Written by the indexing model from the issue text.