N1QL permissions errors should better explain what permissions are needed

N1QL's current message when it refuses to run a query conveys little information about what permissions are actually required to run a query. Error messages tend to be of this form:

        {

            "code": 10000,

            "msg": "User does not belong to a specified role. Keyspace default:closedbucket."

        }