don't require superset of permissions to :read_profile
don't require superset of permissions to :read_profile

test plan:
 - an account admin with "Manage login details for users" should
   be able to view /api/v1/users/X/profile on another account admin
   even if the other admin has additional rights
   (an admin still cannot masquerade as someone with additional rights)

fixes ADMIN-580

Change-Id: I27fb6735e7a08586b7292ef4c94ce5c143f91529
Reviewed-on: https://gerrit.instructure.com/149326
Reviewed-by: James Williams  <3a5f4ed991dbfa5c9ef76ad729d240ca12f62180@instructure.com>
Reviewed-by: Carl Kibler <7c2b40129dd885a147d5b2dda56dda016b9a8f57@instructure.com>
QA-Review: Mysti Sadler <431d062aff1e8f25416b3a7b732fe6effdb03f9a@instructure.com>
Tested-by: Jenkins
Product-Review: Jeremy Stanley <b3f594e10a9edcf5413cf1190121d45078c62290@instructure.com>

sfu/canvas-lms,djbender/canvas-lms,djbender/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,djbender/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,djbender/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,sfu/canvas-lms