Thanks for cleaning this up.

I'm a little confused about the json logic, as the json "roles" field is part of the `groups` table (not the permissions table like you've written), but only in 2.3. In 2.2 (where this PR is being sent) the `permissions` table does not have any JSON.

So... what? :)

Could this be sent to 2.3 where we DO have the json?