use correct keystone-api role in searches

- also fix up vncproxy recipe