First pass implementation of a working RBAC system

[chriscarrollsmith]

• Restructured database models with correctly specified many-to-many relationships
• Added unit tests for restructured database models
• Added a working organizations.html component with Create Organization button to the user profile page
• Almost entirely rewrote the organization and role routes
• Used POST and GET for all routes, because HTML forms don't support other methods (closes Assess whether we should use POST methods for all operations or introduce other methods #51)
• Used eager loading of user's roles and organizations in all authenticated routes so we have easy access to their permissions and such
• Moved user password to a separate database model (just to make it a little less likely that this gets accidentally exposed to the client)
• Created a preliminary user/organization.html page that needs to be extended to provide an interface for all organization/role management functionality