Invest: By default have a siteuser-live and a siteuser-preview configured

I'd like to achieve two things with this:

1) Make sure that the siteuser-live cannot even read documents in -draft or -preview state : This can be seen as an extra safety guard
2) Only flush the 'live' session pools when there is a change in a document / folder that it can actually read! Thus, we do not need to flush the sessions in the session pool any more when a draft or preview is saved / added / removed