Finish implementation of must_be decorator

Converted a few uses to use the proper userright, which eventually
all uses should use instead of a specific group

Change-Id: Ic7196732b0841a5c3a956fa0c7a2b558eba16371
Merge "Finish implementation of must_be decorator"