Replace authz with roles.py and reconcile their behaviors

@cpennington @chrisndodge @cahrens Please review

This ended up being much more complex and squirrely than I ever anticipated. There were considerable differences between expectations of cms and lms which I unilaterally resolved.