ac4ac - check resource access before creating usergroups

This changes the ac_logic_tier to check that the user who is creating a usergroup has admin permissions on all the resources in the usergroup that is being created.  This prevents users from giving themselves higher access to resources and it also allows users to manage permissions for their resources without having to be given explicit permissions to do so via a separate usergroup.