Allow unenroling single role from user

This is work in progress