path-help doesn't work on some paths

[jacob-faber]

Describe the bug
path-help doesn't work on some paths, for example: vault path-help sys/auth/userpass/tune.

To Reproduce
Steps to reproduce the behavior:

1. Create vault policy (see admin-policy) and associate it to the user
2. Login to vault as a user (vault login -method=userpass username=user)
3. Try vault path-help sys/auth/userpass/tune

Expected behavior
I can read sys/auth/userpass/tune, it should be also possible to see help with path-help.

Environment:

• Vault Server Version (retrieve with vault status): 1.12.2
• Vault CLI Version (retrieve with vault version): v1.12.2
• Server Operating System/Architecture: External vault in docker container

Vault server configuration file(s):

admin-policy

path "*" {
	capabilities = ["create", "read", "update", "delete", "list", "patch","sudo"]
}

Login with user that has admin-policy.

➜  ~ vault login -method=userpass username=user
Password (will be hidden): 
Initiating Interactive MFA Validation...
Enter the passphrase for methodID "2d8ae368-de86-bed8-2604-9d417891b42f" of type "totp": 
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

Key                    Value
---                    -----
token                  hvs.CAESIDqSgwjga3xfj_CYnRm1HfaAYNt8goZXpvDDU5vk7ET9Gh4KHGh2cy41aUVyY2hFSWtBOXXXXXXXXXXXXXXX
token_accessor         wNavuIhpO5yqVHEjOXXXXX
token_duration         72h
token_renewable        true
token_policies         ["default"]
identity_policies      ["admin-policy"]
policies               ["admin-policy" "default"]
token_meta_username    user

I can read sys/auth/userpass/tune path.

➜  ~ vault read sys/auth/userpass/tune
Key                   Value
---                   -----
default_lease_ttl     72h
description           n/a
force_no_cache        false
listing_visibility    hidden
max_lease_ttl         720h
token_type            default-service

I can't get path-help of sys/auth/userpass/tune path - it works with root login.

➜  ~ vault path-help sys/auth/userpass/tune
Error retrieving help: Error making API request.

URL: GET https://vault.example.com:8200/v1/sys/auth/userpass/tune?help=1
Code: 403. Errors:

* 1 error occurred:
	* permission denied