Implement "GRANT OPTION" correctly - as an *option* of another privilege, not as an independent privilege. E.g. after GRANT SELECT ON *.* TO foobar WITH GRANT OPTION; GRANT INSERT ON *.* TO foobar; foobar should be able to grant SELECT but not INSERT.
