instead of checking roles, we should be checking capabilities

[jeffreywescott]

Right now, there are places all over the code that are checking to see if the given user has a certain role. This is wrong -- instead, we should be checking whether or not the user has a given capability. Ideally, this would just be done by the game service itself, and the CLI would just trust the game service to reject the API calls with a correct response.