Shift to using a header, rather than GET parameter for the admin token.
Fix userstamps not working when authenticating via admin api tokens.
Treat roles as an array in the API, rather than a single string.

This just shifts the string logic to the client-side, where it's more
appropriate anyway, since it's only really the selectize component
that's driving the need for a comma separated string value.
Cleanup create/update responses by returning the same rabl template.

This ensures the create/update responses are consistent with the show
method's response.
Change a _id to id in the user settings.
Fix accepting terms and conditions via the admin API.