Add note about superuser and permissions

Had some hard time finding out why my permission methods always did return `True`.