Make roles be expanded upon setting permissions, rather than when getting them.

This solves a problem when doing queries, and as a mongoose user model should
probably hold a 'roles' property, it won't make much pratical difference.