* Use apos.permissions.can to determine what options to display, don't second-guess it.
* New adminOfType option is similar to "adminOnly" but also permits users with the type-specific admin permission. This would be unwise for "people" and "groups" but makes a lot of sense for most other uses of "adminOnly".