added basic permissions with admin, superuser, and player. the user model also now automatically makes a root user if one doesn't already exist. /users is now an admin-only route