Crap,  if you notice we are using rax:message and rax:code to customize the return code and message when the message doesn't match.  These two attributes are part of the rax:message extension....

This means, that if you enable rax:roles...you have to also enable rax:message as well.  Add the appropriate logic in builder.xsl