xform share api endpoint

Pretty sure this could be done more concisely and extensibly with

```python
ROLES = {klass.name: klass for klass in [ReadOnlyRole, ...]}
```