I wonder if this actually ever happens (role and/or user IDs being transmitted in a single field as a comma-separated list).
If it doesn't, we could make that code slightly shorter as well.