Progress on #111. Application/role update logic is still borked.