We need to add something like the following for the 'admin' and 'system admin' global permissions here: http://confluence.atlassian.com/display/JIRA/Managing+Global+Permissions.

Note: A fully functioning system admin will require both the 'JIRA System Administrators' permission and the 'JIRA Users' permissions. A user with 'JIRA System Administrators' will be able to login to JIRA without the 'JIRA Users' permissions, however, such a user may not be able to perform all regular user functions (e.g. edit their profile).

This behavior changed as indicated at JRA-16980. We need to have this in the 4.0 docs. We should also put it in the 4.1 docs. We will have to remove the documentation if/when we fix this bug.