Roles and authorization

This should close (#7) and (#21)