Fix #4537 - user can set empty roles array via API