Return users & permisions for forms & projects

closes #335 
closes #334 
Looks like you only care about values, why not iterate over them instead of doing a lookup, `for role in ROLES.values(): if role.has_role...`