derive the roles from the users hash instead of duplicating data

Change-Id: I7b4d0b2fa7722d6563b4074a45d905a093ee38db