What steps will reproduce the problem?  
1. Define a user with no permissions:
>>> authorizer.add_user('user', 'password', '/home/user', perm='')
2. Try to use the MLST command. 

What is the expected output?  


What do you see instead?  
Even though the "l" permission has not been assigned to the user the client
authenticating as "user" can still use the MLST command.
Although he's not aware of any pathname resident on the server (LIST, STAT
or MLSD should be enabled for that) he can still use the MLST command to
retrieve information about the root home directory.

The server should avoid the usage of MLST command unless the "l" permission
has been specifically assigned to the user.