Implement user roles

In order to enable organization management, provisioning and so on, we're going to need some sort of user roles and entitlements as a prerequisite.

Add to user entity; stored in DynamoDB.

Proposed, for starters:
- `admin`
- `org-owner` (for orgs the user created; reserving `org-admin` for a future in which the owner might delegate admin functions)

We'll need to get clear on whether we are talking about and using personas, roles, claims, entitlements or what.