re-add old rack roles; need to be renamed via API