Add preferences and roles endpoints

This adds end points for setting and retrieving user roles and user preferences for projects. 

While both are stored on the same model, I decided to separate them into two endpoints to simplify handling access control. The `/project_roles` endpoint allows a project owner to set roles for users, and allows users to see what roles they have been assigned. The `/project_preferences` endpoint allows users to update and retrieve their own preferences for a project. 

Let me know if that's a problem. I definitely think it would possible to combine them into a single endpoint. 

Neither endpoint supports a delete action, roles and preferences should simply be unset as part of an update action. 
I don't really have a strong opinion on this. If I create a role that already exists, it probably shouldn't create a duplicate, sure. Getting an error back would probably be more predictable behavior than silently turning into an update, and we can ignore the error in the UI if there are no consequences.

I can't see any situation where I would try to update a role without already having its ID.

So my vote is: "create" creates, "update" updates. If the client tries to do something nonsensical, give it an error.