dry out authorization to manager admin pages
only managers can create sets
user update callbacks
move managees_sets_for_select to helper