Clarify supuser permissions

fixes bug 1087298

This sets up some switching so that superusers no longer have individual
permissions enumerated, since they implictly have all permissions. This avoids
the confusing situation where a superuser is told "you have all permissions"
and then told about some missing permission because of the group the user
account is in. Since we honor superuser status over group status, avoid
confusing the user and display that first.