Refactor to avoid conflicts between Permission.excludes and Permission.needs

[danwuSBU]

We can get into a weird state with conflicting logic by doing the following:

d = Denial(('a', 'c'))
p = Permission(('a', 'c'))

u = d.union(p)
#  now u has ('a', 'c') in BOTH needs and excludes

With this refactoring, a need can be needed or excluded, but not both. This change is not expected to break anything and just handle the edge case described above.

[Abdur-rahmaanJ]

closes #78