Both user and role need to be set in a user form.

However, if both user and role are not set, the form validation should pass.
This is why the required=True approach was flawed.