Added support for permissions that can have an 'All' option and (optionally) default to it.

This will be used by oa_workbench for it's oa_access permissions.