Sql tweaks

Please review! (cc: @sol @jekor @tuleism @lenguyenthedat @shlevy)

I've added a rather lengthy section explaining how the privilege logic works. I felt this was necessary as especially the longest-matching-path rule continued to cause confusion. Anything I could do better?

Also, I've removed a `JOIN` in the authorization query that I think is redundant. Can someone confirm this, please?