[FIX] account: don't make administrator part of account users group by default

Before that, the administrator could use accounting features by default. This is not what we want, the group only gets assigned by default when installing account_accountant, on enterprise.

addons/account/security/account_security.xml

@@ -41,9 +41,8 @@
         <field name="implied_ids" eval="[(4, ref('group_account_invoice'))]"/>
     </record>
 
-    <!-- Grant full accounting features to admin -->
     <record id="base.user_admin" model="res.users">
-        <field name="groups_id" eval="[(4, ref('account.group_account_user'))]"/>
+        <field name="groups_id" eval="[(4, ref('account.group_account_invoice'))]"/>
     </record>
 
     <record id="base.group_system" model="res.groups">

addons/account/tests/test_reconciliation_widget.py

@@ -14,6 +14,9 @@ class TestUi(odoo.tests.HttpCase):
         if not bank_stmt:
              _logger.exception('Could not find bank statement BNK/2014/001')
 
+        # To be able to test reconciliation, admin user must have access to accounting features, so we give him the right group for that
+        self.env.ref('base.user_admin').write({'groups_id': [(4, self.env.ref('account.group_account_user').id)]})
+
         self.phantom_js("/web#statement_ids=" + str(bank_stmt.id) + "&action=bank_statement_reconciliation_view",
             "odoo.__DEBUG__.services['web_tour.tour'].run('bank_statement_reconciliation')",
             "odoo.__DEBUG__.services['web_tour.tour'].tours.bank_statement_reconciliation.ready", login="admin")