Reduce signon admin priveleges

https://www.agileplannerapp.com/boards/173808/cards/5255
https://www.agileplannerapp.com/boards/173808/cards/5254

Simplify and restrict what users are able to do on Signon.

 * 'Filter by Role' shows roles that are appropriate for the current user
 * Only be able to administer users lower in the permission hierarchy
 * Restrict the abilities of Admin and Organisation Admin users
 * Can only grant users permissions for apps that the admin user can access
The list of applications that the admin can't access will be disabled on the client side. On the server side, the permissions will be reloaded and merged with the user params to make sure the permission changes are only those that the admin can make.

I'm working on this at the moment (along with additional tests)