api/users: disallow guests from updating any user
core/apiRouter_test: remove a couple art tests which require an actual file
API: add documentation about user roles and permissions