Implement hidden permission in profile editor

Accounts with "directory_hidden" permission (ie. people allowed to read
and update almost every information in the directory) need to be allowed
to read attributes flagged "private" (because the order of the
visibility flags is public < ax < private < hidden).

While at it, explicitly allow admin accout to read hidden values too.