Yes, nsadmin is a member of the group web.
So I did more digging and found this bug with a patch provided, and this other patch. This is a rather surprising bug to go unfixed. Does anyone have experience with either of these patches?
