use a single validation error handling function
add one role validation method to be used in child objects
use a validation_error method which also does logging
Merge pull request #782 from mapleoin/one-role

+1 from me; also got smoketested => merging.