revisit cascading permission design+solution

We're going to stop forcing this.  Each card's permissions can be configured independently.  Default permissions still work the way they used to, but there is no longer a concept of "incompatible permissions" -- if there is a conflict, it goes with the permissions on the left-side card.