Team permissions should override the 'all group' (and some minor clean-up)

This is the Group/Team intersection stuff we talked about the other day. I also included some random little clean-up that I found while hacking on this.