Add/update users picks lowest role_id

This fixes, for example, iPeer superadmins who enter through external LMS where they are instructors and lose superadmin privileges at login.  Now, highest level (lowest role_id) is preserved.

- v1_controller compares external id to ipeer id (if saved) and chooses lower
- new users created in test cases for this functionality:
  - same external vs ipeer role_id
  - external role_id higher than saved in ipeer
  - external role_id lower than saved in ipeer