Filter users that can record based on their roles

The roles are taken from the federation, and a few can record automatically.

refs #1287