ReadOnly user can add directories as Target Document without Write permissions to them

After adding read only permissions to a user in one domain, when we login with that user we can use the Nuxeo Upload with Aspera and upload a file to webui and give permissions to other users to see that document

How to reproduce:

• With Admin create a user and give Read Only permission in the Domain to it
• login with Read Only user
• go to Nuxeo Upload with Aspera
• upload a document adding a workspace in the Domain as a Target Document(error - with Read Permissions you shouldn't be able to choose directories besides your own userWorkspace)
• edit the rest of the metadata
• complete transfer - operation fails with message:
  Failed to invoke operation FileManager.Import, Not enough rights to create folder --->(should fail early)