Adds documentation of proposed role based access control

[bwalsh]

This PR adds documentation for a proposed RBAC convention where each institution will have its own /program. Assigned users in that institution will have the capability to approve new projects and grant users the ability to read and write to them.