Add preferences and roles endpoints

This adds end points for setting and retrieving user roles and user preferences for projects. 

While both are stored on the same model, I decided to separate them into two endpoints to simplify handling access control. The `/project_roles` endpoint allows a project owner to set roles for users, and allows users to see what roles they have been assigned. The `/project_preferences` endpoint allows users to update and retrieve their own preferences for a project. 

Let me know if that's a problem. I definitely think it would possible to combine them into a single endpoint. 

Neither endpoint supports a delete action, roles and preferences should simply be unset as part of an update action. 
We could definitely define custom methods to remove access control filters, but access_control_for doesn't have any of its own defaults. Controllers inherit this behaviour from ApiController. 

We could change this to be a redefine if we impose a rule that there can be only one access_control action for each controller action, so `access_control_for_update` is enough to identify the filter.