Minor tweaks to auth apply display

Only display positive permissions.  I'm not sure why it made sense to
always show membership in institutions.