mattdrayer/api-moderator-role-valiation: Confirm add/remove of role

@chrisndodge, additional validation around the forum moderator role
hmm. I'm not sure this is right, shouldn't the revoke_access happen and then do these queries and the it should be:

if len(queryset) == 0

?

Consider this use case:

add_role('instructor')
add_role('staff')
remove_role('staff')
remove_role('staff')  [not a typo]

this above case would remove the forum moderator, no?