Reduce signon admin priveleges

https://www.agileplannerapp.com/boards/173808/cards/5255
https://www.agileplannerapp.com/boards/173808/cards/5254

Simplify and restrict what users are able to do on Signon.

 * 'Filter by Role' shows roles that are appropriate for the current user
 * Only be able to administer users lower in the permission hierarchy
 * Restrict the abilities of Admin and Organisation Admin users
 * Can only grant users permissions for apps that the admin user can access
sorry, i should have explained with a bit more detail, this is a tricky one.

0. say i'm a normal user, with access to Whitehall and Publisher.
0. an admin with access to only Whitehall, wants to edit my email address. they go to edit screen and only see Whitehall listed there (agreed).
0. when they edit my email address and press submit, my permissions get reduced to have access to only Whitehall. you can see the params that get submitted here to understand this issue better.