Add InstanceUser model; move 'role' and 'repuation' from User model

3 migrations:
* Schema: create InstanceUser
* Data: create an InstanceUser for each existing role of each existing user
* Schema: remove 'roles' and 'reputation' from User
Update Role and Repuation code to access InstanceUser

A User object no longer has "roles" or "reputation" -- for that you need an InstanceUser.
My strategy is to mostly avoid accessing InstanceUser directly, using instead User methods
get_role(), get_reputation(), and get_instance_permissions(). (Internally these access
get_instance_user(), which is available when necessary.)

So in this commit we update all the code which interacts with role and reputation.

Note that like User.save(), InstanceUser.save() saves with the system_user.

One bug fix:
* In create_plot(), don't create plot if tree height is invalid
Update OTM1 migration logic to use InstanceUser

* Create an InstanceUser for each User, with the instance's default_role
* more_permissions() applies role to InstanceUser, not User
get_instance_user() returns None rather than throwing an exception

Callers must do something sensible, like using the instance's default role if a role what they're after
Record users that update role permissions
Expose `make_user` to all
Fix typo
Update tests to support instance users
Whitespace cleanups
Merge pull request #173 from ahinz/topic/add-instance-user-updates

Topic/add instance user updates