refactored services.role_check into a decorator.

cached role_bucket into user session
added permissions
remove user permission checks for creating collection
Instead of using strings for the roles, it would be better to use symbolic constants. Perhaps create a `const.py` that defines these roles?