I am not sure if this is correct behavior? Is it backward compatible? what you do, is that if there is no roles specified, then user is removed from all roles.