'userAddable' flag in permissions.  Only allow non-admins to add permissions
that have this flag.