[api, webui] remove change_role in API and add a relationships controller

This makes the API routes clearer and the webui code uglier, but it's a
step in the right direction of clearer controllers in API