implement user roles

[revan-wy]

(break up if needed)

• super/admin
• account holder
• admin can view all accounts and users, regardless of status;
• account holder can only log in if active;
• account holder can only view account if active;