Endpoints for giving and taking roles

[towerofnix]

(Future pull-request makers: Please don't use this as an example pull request. It doesn't actually fix any existing issue (where a proposal should be); instead it's mostly spawned from external discussion.)

Removes roleIDs in PATCH /users/:id. Adds three new endpoints:

• POST /users/:userID/roles - Give a role.
• DELETE /users/:userID/roles/:roleID - Take a role.
• GET /users/:userID/roles - List roles.

Note that this does not remove roleIDs from GET /users/:id, but does remove it from PATCH /users/:id.

[bates64]

Actually, nevermind - returning the changed document is inconsistent.