Add user roles and permissions to API endpoints.
Expose permissions to client; Fix 403 error.
Fix merge conflicts.
Share user permissions code between server and client.
Use mixins to share User class between client and server.
Merge branch '1214_user_authorization' into develop