mattdrayer/api-moderator-role-valiation: Confirm add/remove of role

@chrisndodge, additional validation around the forum moderator role
Not as a PR blocker, but it seems like this "has permissions check" should be a utility method in the forums code.