Proper authorization: find roles also via group membership
Improved logging