LUN-954 -- Only unassign the user from the non-site-wide group once he has no more page permissions on any of the sites

* unassigning him otherise would cause him to loose his role on ALL sites, not just the one passed in as an argument to ungrant_from_user
* also do a couple of small refactorings to the non-site-wide unit tests