Handle user roles when fetcing from HarvestAPI

* Add ROLE_ADMIN if user is admin
* Remove ROLE_ADMIN if user changed to not admin
* Added cmdline option preserve-roles
If set then user roles isn’t removed from db
* In /admin/users show if user has ROLE_ADMIN