fix #5216: merge grantedAuthority checks for existing grantedAuthority first and...