users: getRoles() moved to Acl