removing 'permissions' from valid update keywords for role update, movin...

...g manager functionality out of authorization.py, removing duplicate declaration of permission operation constants in permission.py and adding missing unit tests