ALM-282 added more test coverage for roles permissions. API requests via localhost no longer require key.