Support roles better

Add some nice syntax, along with tests and docs, for specifying roles
and permissions with Flask-Principal
add a 'get' method
rename roles to actions

This gives a more granular permissions model and maps better to what
users are and are not allowed to do.
Merge branch 'roles'