Fix behavioral bugs in db.addUser js helper.

db.addUser() should not visibly mutate the input object.
db.addUser() should not require the 'roles' array to be nonempty.