User permissions

[esmithayer]

• Adds four user roles: Patient, Staff, Admin, and Superuser. New users have the Patient role by default.
• Patient users are directed to the new patient page upon first login. After saving the patient, they're always directed to that patient's profile when they login. Patient users shouldn't see the landing page, so the "Search patients" link in the nav bar isn't visible to them. If they try to access the landing page or another patient via the URL, they'll get a 403 error.
• Staff, Admin, and Superuser accounts behave the way all user accounts did up to this point. In theory, Admin users will be able to access admin pages for their organization, and Superusers will be able to access admin pages for all organizations. We don't have admin pages yet, so they're all effectively the same right now.
• Updates mock data scripts to add roles and add a patient user, and updates some tests to take roles into account.