Close #677. Extract coordinator.Permissions

All ClusterAdmins now qualify as DbAdmins too.