Add test where `a from b` is directly assigned but contains `user:*` or `user#relation` errors out

> Add a test that ensures that if b in the case of a from b is directly assigned but contains user:* or user#relation that we error out too.

e.g.
```
define parent: [folder:*]  
define viewer: viewer from parent  
```
```
define parent: [folder#parent]  
define viewer: viewer from parent  
```

Run against the current API and see if it properly validates against this case.