Added a sanity check / validation that roles can be assigned if RBAC is enabled.

The sanity check verifies that the current model does not prevent roles from being assigned when RBAC is enabled.  However this has it's limits as we can not cross reference users and groups in the stores configured on the realms.

Also included is a commit to prevent empty <include /> and <exclude /> elements being written.