empty access mask is only denied on SMB2