fixes #2630 - restrict assignment of roles to those a user has (CVE-2013-2113)
fixes #2631 - fix remote code execution via controller name (CVE-2013-2121)