Introduce ROLE_REFINEUSER and restrict api operations to that user. closes #131