Here's a couple of sections from my /etc/cups/cupsd.conf file that seem to be relevant. I don't understand what they mean, but I'm just betting someone here does:
SystemGroup lpadmin root
BrowseLocalProtocols CUPS dnssd
Then farther down, there's this:
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
Require user @SYSTEM
To my simple brain, reading this it seems that the only thing I should need is my own user name and password to add or modify a printer, or at worst, "root" as the user and my root password. I am mystified.