Implement user roles

[jayhill]

In order to enable organization management, provisioning and so on, we're going to need some sort of user roles and entitlements as a prerequisite.

Add to user entity; stored in DynamoDB.

Proposed, for starters:

• admin
• org-owner (for orgs the user created; reserving org-admin for a future in which the owner might delegate admin functions)

We'll need to get clear on whether we are talking about and using personas, roles, claims, entitlements or what.