generics: getRoles now returns Set<Role>