Comment 6 for bug 1497322

I've pushed a branch called user/gmcharlt/lp1497322_further_testing that includes a unit test as a well as a follow-up that allows search on /only/ the profile. Leaving open for further testing; note that as mentioned in my follow-up, I suspect that we may want to mark the permission.grp_descendants() function stable.