Pylons/substanced — pull request #141 by tseaver (2013-09-12 18:45:23+00:00)
Title: Safely allow non-privileged users to update their preferences.

- Grant them 'sdi.edit-properties' on their own user object.

- Move the 'groupids' field to a new propertysheet, protected by a new
'sdi.manage-user-groups' permission.

- Still allow admin to set groups during the add view.

Fixes #140.