fix moderator create badge

This prevents moderators (more generally any user with `can.user.supervise()` but without admin permissions) to set groups on badges. This way these users are prevented from changing their own group.

I could not find any difference between `can.user.manage` and `can.user.supervise` so I removed the former in the first commit.