New platform roadmap doc

User administration needs to move to an application that is not based on CORS and has a server component behind it, i.e. a controlled environment.  It is not secure to expose functionality like deleting a user, inviting other users into your careteam, etc. via anything other than a completely Tidepool-controlled environment.

It is possible to implement Blip such that it is running with only using CORS for data access and served directly from a server with server-side logic.  It is possible to do that instead of implementing a separate app and then at a later date pull the visualization functionality out of blip and into its own application, if that is the preference.  But, exposing user and careteam management functionality over a generically accessible platform API is irresponsible and insecure.