Use Plone api to grant roles