put privacy role selector in settings page. Change visibility of various permissions items accordingly.
reset ACL just in case it was custom already.
couple of other places where we need to reset stuff completely if the role changes