More progress on replacing canManagerTeam() with rights checks.