s3: For read-only shares, filter out write bits from conn->access_mask