Card #224 support for bulk creation of staff users, remove unit admin ability to remove grouproles from staff (as in patients), more strict permissions in ui for staff