Proposal for #1588

[crazycatdevs]

Found by: CrazyCat
Patch by: CrazyCat
Fixes: #1588

One-line summary:
initialize ok to -1, sets it to 0 if user is known

Additional description (if needed):

Test cases demonstrating functionality (if applicable):

[thommey]

Unfortunately we can't do that, because you break code of the inverse logic:

if {[matchattr $hand o|o $chan]} { # privileged code }

would suddenly give access to the "*" handle.