fix access checks

Author: ThomasKranitsas

src/services/ResourceService.js

@@ -256,7 +256,7 @@ async function init (currentUser, challengeId, resource, isCreated) {
     // Check if user has agreed to the challenge terms
     resources = await helper.query('Resource', { challengeId })
     if (!_.get(challenge, 'legacy.selfService')) {
-      if (resourceRole.selfObtainable || _.toString(memberId) !== _.toString(currentUser.userId)) {
+      if (!resourceRole.selfObtainable || _.toString(memberId) !== _.toString(currentUser.userId)) {
         // if user is not creating/deleting a self obtainable resource for itself
         // we need to perform check access first
         await checkAccess(currentUser, resources)