Add role-based Access control features

[samschurter]

Administrators should be able to create roles and define what features that role can access. They should then be able to mass-assign roles. Perhaps from the existing user list in the admin pages?