Define middleware for role based access.

[david-rocca]

Currently, there are the following Roles defined for an Org:

CNA
SECRETARIAT
BULK_DOWNLOAD

Currently, there are the following roles defined for a User:

ADMIN

We need to have a middleware that is flexible to add more roles and to limit access based on those roles.

Currently, if a user is a member of an Org they inherit the roles of that Org. Going forward, we also want this middleware to be aware of the "ReportsTo" and "Oversees" fields in an Org. A user that is an admin of an ORG that oversees sub orgs should be able to edit and add users and data in that org.