Patch a user roles bug with the new 'allow/deny' setting