fixes the admin menu so tool permissions admin is displayed when the user has
project security permission, not tool configure permission (otherwise you can
get into problems where no one can access the tool, and no one can admin perms
for it either)
fixes some queries so that we look for roles in the root project of a
hierarchy instead of a subproject (was causing breakages when trying to add
groups to subproject permissions)
fixes the redirect on permission admin to stay on the permission screen
