Safely allow non-privileged users to update their preferences.

- Grant them 'sdi.edit-properties' on their own user object.

- Move the 'groupids' field to a new propertysheet, protected by a new
  'sdi.manage-user-groups' permission.

- Still allow admin to set groups during the add view.

Fixes #140.