Refactor to avoid conflicts between Permission.excludes and Permission.needs

[danwuSBU]

We can get into a weird state with conflicting logic by doing the following:

d = Denial(('a', 'c'))
p = Permission(('a', 'c'))

u = d.union(p)
#  now u has ('a', 'c') in BOTH needs and excludes

With this refactoring, a need can be needed or excluded, but not both. This change is not expected to break anything and just handle the edge case described above.

[Abdur-rahmaanJ]

The PR is great. Thanks for spotting the issue and thanks @kevin-brown for the input.
Just PR docs should be in the format [ statement ] -> code explanations.

Flask-principal was keeping records for both needs and excludes. This PR simplifies the logic by keeping only needs, reducing excludes to not needs.

[Abdur-rahmaanJ]

closes #78