user can describe table though no rights given; using HdfsAuthorizationProvider

With hive.security.authorization.manager set to HdfsAuthorizationProvider
and a database with a table, where both database directory and the inclosed
table directory had permissions:

drwx------ - user1 users

the user 'user2' could do both a 'show tables' on the database and a
'described formatted' on the table.

Both of these operations correctly failed with HCatalog 0.2.