CAS updates should require P.MODIFY AND P.SELECT

With CAS it is possible to simulate a SELECT query using conditional UPDATE IF. Hence all CAS updates should require P.SELECT permission, and not just P.MODIFY.