network user/group can have role (closes #3857)