Change effective privileges in some cases

[a-tze]

Especially users having "high" roles but being restricted to some projects do have effectively access to many things they shouldnt have. Especially the global settings like workers, encoding profile (contents/properties) etc. should be inaccessible to a user that is restricted to projects.

[jjeising]

@a-tze With the new restricted superuser role, is this still an issue?

[a-tze]

@jjeising Forget what was originally here.

[a-tze]

Looks good