removing 'permissions' from valid update keywords for role update, moving manager functionality out of authorization.py, removing duplicate declaration of permission operation constants in permission.py and adding missing unit tests