Rewrote the code that builds the tree representation of the privileges, since the initial version was based on the false assumption that children could only appear once in the tree. Fixes #887.
Changed the permission grant page to use the new 'party_search' widget which allows to search for the party to grant permission to within the form, and to display the privilege hierarchy in a html tree, to convey visually the information about privilege inheritance. This includes a big hack to build the hierarchy in tcl in the oracle version, since it can't be queried directly (join doesn't like connect by in 8i).