Above neighborhood admins, we should have site-wide admins. /nf/admin/ already special-cases members of the Allura project to be like site-wide admins. Formalize that so it applies to all access checks (not just /nf/admin). And make an ini setting so that the special project (allura) is configurable