volume.query: don't bother with empty query strings
Grant superusers full download privs