bring over david's fix for hidden checkbox, optional roles, safer new user