Multiple private keys per user + RO/RW access level

This PR actually introduces several new features:

1. Each public key can have several private keys
2. Each private key can be specified as a "read only"-key (cannot add images, update metadata etc)
3. Allows for custom user backends (fetch public/private keys from database or similar)

It includes some of the work from Christer's issue-289 branch and builds on it.

This should solve both #289 and #306 .