Query-update - can update any bucket

1. Create 2 buckets - 1 and 2. Create primary index on bucket 1 and 2. (testbucket and travel-sample) - testbucket is an authless bucket
2. Create a user and give query-update role to bucket 2 (travel-sample)
3. Login and user and run update statement against bucket 1. (testbucket0

Expected result - user does not query-update role on bucket 1 (testbucket), hence should be unauthorized.

Actual result - user is able to execute update statement on bucket1(test bucket)