We are not checking if the rolename is one of the permitted ones. That may cause an exception here, or also be a security issues if the API is only of instructor, staff or beta.