Add preferences and roles endpoints

This adds end points for setting and retrieving user roles and user preferences for projects. 

While both are stored on the same model, I decided to separate them into two endpoints to simplify handling access control. The `/project_roles` endpoint allows a project owner to set roles for users, and allows users to see what roles they have been assigned. The `/project_preferences` endpoint allows users to update and retrieve their own preferences for a project. 

Let me know if that's a problem. I definitely think it would possible to combine them into a single endpoint. 

Neither endpoint supports a delete action, roles and preferences should simply be unset as part of an update action. 
I agree re 2 distinct endpoints, no sti.

If this code is only for the UserProjectPrefs then it's ok. If it'll be reused then break it apart and call the correct create / update module method from the calling context.

Error seems to be more inline with resource access but won't give a good user experience, @brian-c thoughts on how this should work?