Role Hierarchy was missing. Now, a user can do all privileged for his role and the roles below
Allow _content_type parameter