Covering RailsRole.provision, plus refactoring a bit