Ensure Role.ad_path is not blank if present
Prefer to AD sync roles by GUID. Record GUID if not present.