yeah, when it was in users.rb, it looked like this:   
`  def all_roles
    @all_roles ||= (login=='anon' ? [Role[:anon]] : 
      roles(force_reload=true) + [Role[:anon], Role[:auth]])
  end`

We really need to make sure user permission queries are not run with every request.  Not in this branch, perhaps, but definitely soon.