PermittedPagesSearch - makeProhibitedGroupPermissionsQuery(User user)

Loops through groups twice, each group which the user does not belong to is added to the the query (memory usage if many groups have been imported).

We need to perform the LuceneQuery without loading all groups. Charles has proposed that we build the exclusion list by consulting Lucene prior to the permission check.

It all seems a little odd to me - we should be able to ask Lucene for content which is indexed for groupx alone.