Add methods for changing user roles to index and User.class controller

Of course it is needed. The backend can be accessed without the GUI. If a user directly triggers a route the function has to make sure the user has the right to do that.