Improve security of and make optional certain user API parameters

This brings over the hidden isAdmin checkbox from @davidkaneda's dropbox branch (this code doesn't work so well without it) and then actually makes the marked "optional" fields (in the apidoc) optional. It also adds to the apidoc the fact that the API takes an array of roles.

Finally, it does not allow non-administrators to submit roles. 

A note about a past suggestion of using something like `_.extend user, _.pick req.body, 'name', 'email'`: I believe Mongoose's Document#set behaves similarly, and `_.pick` does not add `key: null` to the returned object if a parameter is missing so it should be okay to use this pattern of `document.set _.pick req.body 'param1', 'param2'` for optional API field edits.
Ah, sorry! Thought it was coming from the bucketUtil class from another PR — that's fine :)

On Mon, Sep 29, 2014 at 6:10 PM, Scott Hulbert <notifications@github.com>
wrote:

>> @@ -93,13 +96,19 @@ app.route('/users')
>>      return res.status(401).end() unless req.user?.hasRole ['administrator']
>>      return req.status(400).end() unless typeof req?.body is 'object'
>>  
>> -    newUser = new User req.body
>> +    data = _.pick req.body, 'name', 'email', 'password'
>> +    newUser = new User data
>> +    
>> +    # optional
>> +    if req.body.roles? and isArray(req.body.roles)
> `util#isArray` is part of node core http://nodejs.org/api/util.html#util_util_isarray_object
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/asm-products/buckets/pull/70/files#r18194492