Ensure program owners have RoleReader in admin context

* before, it only checked if they have RoleReader in *some* context, but
  admin context is required
Hide 'RoleReader' role from services
Merge pull request #258 from reciprocity/feature/additional-fixes

Two fixes for RBAC