adjust groups and users startup scripts to allow custom codename filter

initializers/users.yml

@@ -4,10 +4,10 @@
 #   password: reader
 # writer:
 #   password: writer
+## specify explicit permission codenames or codename filter functions and filters to match on
 #   permissions:
-#   - add_device
-#   - change_device
 #   - delete_device
-#   - add_virtualmachine
-#   - change_virtualmachine
 #   - delete_virtualmachine
+#   - codename__startswith:
+#     - add_
+#     - change_