As with #99, I think this needs to go a step further and make sure that the selected roles are the expected roles after saving, rather than basing success on the flash message.