condense role api's

[DAC098]

the api's for adding/removing users/groups to a role can be condensed into a
single request for updating the role itself. additional fields can be added the
json body for performing this logic for both users and groups.