Bug 1393767

Description of problem:
Web wrongly displays private access policy as shared access

Version-Release number of selected component (if applicable):
openshift v3.4.0.24+52fd77b
cockpit 118

Image id on test env:
$ docker images | grep registry-console
registry.ops..../openshift3/registry-console 3.3  f8a757a055c5 2 days 223.8 MB


How reproducible:
Always

Steps to Reproduce:
1. On Overview page, click 'New project' 
2. Input name xxia-private, in Access Policy, select 'Private: Allow only specific users or groups to pull images', click Create
3. On Overview page, check the lock icon for project xxia-private
4. Click nav menu 'Projects', select one shared project, click 'Project access policy', change Access Policy to 'Private ...', click Change. Then click 'Project access policy' again, check Access Policy

Actual results:
3. The lock icon is unlocked, see attachment.
4. Check again after Change, Access Policy is still 'Shared: Allow any ...'

Expected results:
3. The lock icon should be locked
4. Access Policy should be 'Private ...'

Additional info:

The CLI policy is correct, though. i.e. it does not has this line:
registry-viewer  /registry-viewer  system:authenticated

$ oc get rolebinding -n xxia-private
NAME                    ROLE                    USERS     GROUPS                                SERVICE ACCOUNTS   SUBJECTS
registry-admin          /registry-admin         xxia                                         
system:deployers        /system:deployer                                                        deployer
system:image-builders   /system:image-builder                                                   builder
system:image-pullers    /system:image-puller              system:serviceaccounts:xxia-private
admin                   /admin                  xxia