DOCS-1693: roles is not optional in new-style auth documents.