Add a new user API for the notifier

This new endpoint is designed specifically to fill the needs of the
notifier and should not be used by other clients.

@jimabramson @nasthagiri 
Ok.  I expected the .all for the user.course_groups and the user.roles.  But I would have expected role.permissions.filter to *not* increase the number of database queries.