lots of reworking of permissions here, this resolves these two issues:
http://bugs.web2project.net/view.php?id=1237 (missing permissions) and
http://bugs.web2project.net/view.php?id=1284 (undeletable permissions)
by starting with this fix:
http://bugs.web2project.net/view.php?id=1284 and then:
-  fixing an accidental assignment in a conditional (line 33);
-  changing how a module vs object is permissions checked;

since a user is never allowed to edit or even see permissions related to a module/object he can't see, it *is* possible to block yourself out of a company and then not be able to remove the permission.. yes, it's annoying but it's the only way to ensure that someone can't create a user with higher priviledges than their own