Two fixes for RBAC

1. make sure RoleReader is enabled in the admin context
2. don't make 'RoleReader' role available via services