Move to privileges vs roles

[paxtonhare]

Rather than relying on hard-coded roles, move to a privileges approach.

Define 2 privs: mdm-admin and mdm-user.

Then update the internals to assert the privs before allowing stuff to work.

This is in-line with how the REST-API in ML works. It also removes the need to create the mdm-admin and mdm-user roles. You can instead just assign the privs to your users.