honor the keystone/api_role attribute

requires bumped versions of osops-utils and keystone