Add preferences and roles endpoints

This adds end points for setting and retrieving user roles and user preferences for projects. 

While both are stored on the same model, I decided to separate them into two endpoints to simplify handling access control. The `/project_roles` endpoint allows a project owner to set roles for users, and allows users to see what roles they have been assigned. The `/project_preferences` endpoint allows users to update and retrieve their own preferences for a project. 

Let me know if that's a problem. I definitely think it would possible to combine them into a single endpoint. 

Neither endpoint supports a delete action, roles and preferences should simply be unset as part of an update action. 
I'm treating roles and preferences as two distinct API resources even though they are one database object. I'm open to changing that implementation if you think it'll be problem (maybe to STI). Thus a user or project owner could post a change to this endpoint not knowing that they may already have a model created. 

It made the most sense to me to just update the existing model in cases like that rather than returning an error, since the API client may not have a way of locating the original object's id. 

However, I think it would make sense to return an error in cases where a role or preference had already been sent, since in that case the client should have the resource's id as part of either the user or project response. 

This can also be documeneted in the code.