Full privilege separation

[Jacopo]

If we ever want other groups to archive with us, we'd create staff-but-not-superuser accounts for them.

There is already some support (private access to challenges take the group and user into account), but will need more to be fully effective -- possibly leveraging Django's own object-privilege system.