Prevent accounts with restricted permissions to create greater roles.

fixes #412