better role-app filtering, with platform info and wildcard checks, fixes #167.