Group Trace Membership should show what it can for non-admins

a non-admin user when viewing trace membership should be able to see whatever is possible instead of getting "There are no indirect paths for this entity and group that you are allowed to read".

Showed this to Chris Hyzer - this submission based on his recommendation.

Side note: security.show.folders.where.user.can.see.subobjects might need to default to false instead of true.  he's mulling this over.