fix object auth without app_auth

app/controllers/admin/object_auths_new_interface_controller.rb

@@ -37,10 +37,12 @@ class Admin::ObjectAuthsNewInterfaceController < OrbitBackendController
     users_to_remove = oa.auth_users - user_sat
 
     users_to_new.each do |new_user|
+      oa.privilege_users << new_user
       oa.add_user_to_privilege_list(new_user)
     end
 
     users_to_remove.each do |remove_user|
+      oa.privilege_users.delete_if{|user| user == remove_user}
       oa.remove_user_from_privilege_list(remove_user)
     end
     oa