Todo: should add role management routes. Certainly for adding/removing roles from users at first, and for creating/deleting roles entirely after.

TODO:

POST /users/:id/roles { roles: ['moderator'] } → give roles to a user
DELETE /users/:id/roles/:role → remove a role from a user?
DELETE /users/:id/roles { roles: ['moderator'] } → remove roles from a user

PUT /roles/:role { roles: ['waitlist.join', 'booth.vote'] } → create a new role that contains the given roles
DELETE /roles/:role → remove a role (should also prevent "core" roles from being deleted, in u-wave-core)