Prevent punning DENY_ALL via the 'add ACL' form.

Direct the user to disable inheriting the parent ACL (for non-root).

Fixes #176.
Merge branch 'bug.deny_everyone_all_mystery'