I can't find where this takes place now.  Where are the og roles loaded for the user and then the corresponding global permissions added to the user_access cache?