Attached patch replaces the lone remaining suser() call with capable()
and then removes suser() itself in a triumphant celebration of the glory
of capable().  Or something. ;-)

Small cleanup of capable() and some comments, too.