Refactor Member and MemberRole: Disallow Member.destroy

MemberRoles can't be destroyed by themselves anymore, but Member must
be asked to do this. This allows Member to have control over validating
that each Member has at least one MemberRole and over deleting the Member
itself when no MemberRole is left.

An ugly piece of code makes MemberRole.destroy raise an Exception when
something tries to call it. This should prevent people from accidentally
using it.