isn't the problem that rw is still r, so passes checks for both?
can't you make one rw and the other r(-w)?