Allow rmdom on subdomains of those on the user's ACL