Add readonly user option

Add the ability to make a user read-only, i.e. the user is only allowed to list but not to add, edit or delete.
The default user 'guest' is a read-only user.