refactored services.role_check into a decorator.

cached role_bucket into user session
added permissions
remove user permission checks for creating collection
Shouldn't this also check that role isn't None? Even better, check that role is one of the valid roles.