Documented how adopt_roles in env.py interacts with the SecurityManager API.

There's a surprisingly long comment here, which is amusing because it
documents a pair of methods which take no parameters other than "self"
and whose entire bodies are both "return None".