User should have a role, or roles - not both #1280

Currently on the response of a user, we return array of roles they have. However, on update / create, the client passed the role argument. We should either decide that users only have on role as far as the API concerned, or they have multiple, and you can specify roles when updating the resource.