controllers: only set $_POST[id] for updates (used for unique validation)

because for _creation_, we don't want to pass an explicit id=0!
(it happened to work in MySQL, but it will not work in PostgreSQL,
and we've had reports that it doesn't work in the MySQL-derived Percona
(issue #750).

This fixes the roles controller to match the code in code in users, and in
builder-generated modules.

It's only an issue because the roles controller passed $_POST straight to
the model.  That's not ideal either but I'll fix it separately.
isn't