Fix branch owner adding exclusive ACL

Having the following project access rights:

  Owner  Admin  refs/*            +1: Administer All Settings
  Owner  Blah   refs/heads/x/*    +1: Administer All Settings
  Owner  Blah   -refs/heads/x/*   +1: Administer All Settings

Did not allow a member of Blah to add a new access right starting
with a minus ('-').  This was caused by the ref pattern adding
back in the "-" at the start of the ref when we tested ownership.
Moving it after the ownership test permits this to succeed.

Bug: issue 672
Change-Id: I8842ed89eb8011f06e0bd7b78c8d4df633270491
Signed-off-by: Shawn O. Pearce <sop@google.com>