auth: add query endpoint for user roles
auth: add /represents endpoint
auth: only use 403 status to mean bad Auth header