Add preferences and roles endpoints

This adds end points for setting and retrieving user roles and user preferences for projects. 

While both are stored on the same model, I decided to separate them into two endpoints to simplify handling access control. The `/project_roles` endpoint allows a project owner to set roles for users, and allows users to see what roles they have been assigned. The `/project_preferences` endpoint allows users to update and retrieve their own preferences for a project. 

Let me know if that's a problem. I definitely think it would possible to combine them into a single endpoint. 

Neither endpoint supports a delete action, roles and preferences should simply be unset as part of an update action. 
Does access_control_for :action always update based on test_action?

If so is there anyway we can programatically remove existing access_control_for_methods for the action when redifining via access_control_for? E.g. link 9 below is redefining the existing access_for_update_* method.