* Request resultant-acl only from users root namespace
* Update permissions adapter to always call resultant-acl at users root, with test
* Update resultant-acl to accept failType
* Update permissions service to set permissionsBanner based on resultant-acl contents
* wire it up
* add changelog
* cleanup unused adapter changes
* use getter for shared namespace logic
