Reduce signon admin priveleges

https://www.agileplannerapp.com/boards/173808/cards/5255
https://www.agileplannerapp.com/boards/173808/cards/5254

Simplify and restrict what users are able to do on Signon.

 * 'Filter by Role' shows roles that are appropriate for the current user
 * Only be able to administer users lower in the permission hierarchy
 * Restrict the abilities of Admin and Organisation Admin users
 * Can only grant users permissions for apps that the admin user can access
if i understand this correctly, there's a possibility that an admin can revoke a normal users access to an application that they themselves don't have access to. say,

0. admin can access whitehall
0. normal user can access publisher and maslow
0. admin can revoke normal users access to maslow and publisher, even though they don't have access to these applications.