fixed _build_abilities() to skips non-blessed roles

so roles() can return a list of role names instead of role objects, as documented.