add roles in addition to groups. these are different logical segmentations that are nearly always conflated together in most "quick crud" systems, and never ma

add roles in addition to groups. these are different logical segmentations that are nearly always conflated together in most "quick crud" systems, and never map to reality on things much more complex than "todo list" API stuff. Or, perhaps more specifically, in anything that might end up being considered a 'line of business' app.