Extended roles

I wrote a proof-of-concept for adding two additional roles to the tenant (apart from the default _member_). Additional roles are:
- vo_name - as coming from the x509 certificate
- swiftoperator - as requested by @bhagemeier . That one is true by default but can be switched of by setting add_swiftrole to False in the configuration.