user administrator should not be able to assign system administrator role

An user with manageUsers role should not be able to assign the admin role to anybody.

The problem expands to any role, i think the solution should be implemented in UserManager

When getting the list of available groups for adding to an user it must not return groups that have roles that the current user does not have. This must be checked in the method that adds an user to a group too.

When adding roles to an user group, only the roles of the current user can be added, to avoid people adding roles to their groups.

(NOTE) I have moved this issue from continuum, its a good general issue to illustrate how constraints should be made to work with rbac. I have a similar hacked up solution to this in continuum dealing with project group administrators, but this is a but higher level.