Keystone v3 improvements.

Managers for project group membership, project user membership, project combined membership (users and groups); for group project membership, group users, group roles; for user project membership, user roles.
it's mostly a stylistic point, but most places throughout the codebase I/we have preferred to have a `var manager = this;` and then refer to `manager.safe_complete(...);`, etc. in the inner scopes. Binding the callback to the manager's scope and referencing things from `base.Manager` works, but it just feels roundabout to me. There's no need to import `base` in order to access a method that's already available on the local manager.

This comment obviously applies to all the places you've written the code this way.