vref: third rewrite.

(I think it's the 3rd.  Can't remember now)
DEFAULT_ROLE_PERMS replaced by per repo default.roles option