refactored services.role_check into a decorator.

cached role_bucket into user session
added permissions
remove user permission checks for creating collection
The strings `Guest`, `Student`, etc aren't capitalized like the role strings are in the decorator checks. Shouldn't they be the same? If we have symbolic constants that we can use in both places, that would probably be better.