[webui] make global roles valid xhtml