Add role-based authorization

Closes #3.
Is this an old migration? You mentioned moving everything from Customers to the UserProfile model.