Add roles columns to user.

Users can now have 'admin' and 'tutor' roles.
Add UsersController#create stub, fix CSRF error.

Because registration form is not built with `form_for`, CSRF tokens were
not being inserted automatically.
Check default values for user roles.

Ensure we don't create admins or tutors automatically.
Create a sessions controller.

Manages currently logged-in user -- map /login and /logout to the
appropriate actions.