Roles and adminitrative user

Changes included:
* User now will accept a list of roles instead of a single role
* User now has user_type field: only  "user" and "administrator" is used for milestone1
* check_permissions throw 403 if no permissions
* Other details are on : https://wiki.sourcefabric.org/display/NR/Milestone+1+-+Implementation+details

Please use the function from the corresponding service, we should avoid using `app.data` directly.