[web-api] check user's role;
          update user's role;
          limit guest-user's repo/sub-repo/default-repo/groups operation.