implement a simple role scheme for users

todo: make this look decent
todo: on server prevent granting of systemadminstrator to user, prevent granting of tenant administrator unless user is system administrator