Description:

Server Setup Information:

• Version of Rocket.Chat Server: 0.62.2
• Operating System: Linux, Debian 9
• Deployment Method(snap/docker/tar/etc): snap
• Number of Running Instances: 1
• DB Replicaset Oplog: none
• Node Version: v8.8.1

Steps to Reproduce:

1. Make a role e.g. Client, uncheck all permissions, except "View Direct Messages" and View Joined Room
2. User with this role (Client) goes to "Directory" in the sidebar -> clicks " + " on the right and has a create room window, where can enter channel's name and invite users. But, while inviting users, autosuggestion can show nicknames of all people. In other cases, this user can not find any user, except direct messages.
3. Of course, this room won't be created due to permissions of this type of user.

Expected behavior:

Do not show any other users in autosuggestion. Or, do not show button " + " for creating rooms by users who have not these type of permission.
For example, by adding another permission "Create Channel"