superuser automatically has all permissions
add pseudo-ctnrs to nameserver and soa for permissions checking purposes
extend ctnr checking to all cydns records