Prevent punning DENY_ALL via the 'add ACL' form.

Direct the user to disable inheriting the parent ACL (for non-root).

Fixes #176.