make DomainAdminAuthentication properly honor digest auth

small refactor of permissions scheme to support this.

http://manage.dimagi.com/default.asp?120768