Permission system

The controller should take care of permission in the whole application.

- [ ] `Role` model gets permission fields
- [ ] `req.hasPermission( Model, action )`
- [ ] `NoPermission` Error if the user doesn't have the permission
- [ ] set default Role, where users get assigned to, during signup
- [ ] create CRUD-Method for Role
- [ ] basic Admin-Interface