Add test where `a from b` is directly assigned but contains `user:*` or `user#relation` errors out

[d-jeffery]

Add a test that ensures that if b in the case of a from b is directly assigned but contains user:* or user#relation that we error out too.

e.g.

define parent: [folder:*]  
define viewer: viewer from parent  

define parent: [folder#parent]  
define viewer: viewer from parent  

Run against the current API and see if it properly validates against this case.