Need a finer-grained permissions model for users

[blerner]

The Student/Grader/Assistant/Professor/Admin split of roles isn't flexible enough for some scenarios. For instance, currently only a Professor can assign grading to individual Graders. Most Assistants shouldn't have that power, to avoid favoritism, but making someone a Professor has the additional power that they can impersonate any user in their course, and can go on to create additional courses themselves. In other words, when a professor of a course wants to delegate some of the authority of managing the course to a trusted assistant, they have to "round up" and grant too much power.