REVIEW: Call runRead, not runWrite

SecurityXmlUserManager getUserRoles and searchUsers are read-based
methods, but are calling runWrite to run their actions. Acquiring a
write lock for these operations is unnecessary. They should be calling
runRead