fixes #812 - new permissions model, user group role and nest support, role filters for better granularity

Contributions from:
* Daniel Lobato <elobatocs@gmail.com>
* Joseph Magen <jmagen@redhat.com>
* Tom McKay <thomasmckay@redhat.com>
* Greg Sutcliffe <gsutclif@redhat.com>
* Dominic Cleal <dcleal@redhat.com>
fixes #3475 - make it possible to force the 401 status.