api role support

Hey Joe,
The general idea is that we want to get role-based filtering into swagger documentation. The idea here is that if the route configuration does not have permittedRoles [current situation] nothing changes. If it does, and permittedRoles is non-empty, filter which operations the requester can see based on req.apiRoles. In CNID, this will require a new [quick, easy] middleware to specify that based on oauth parameters [e.g.] which I'll be coding up; this is just what's needed on this end to make that happen happily.

Let me know if you have any comments!