since domain is not an attr of request, but we have access to domain, just check privileges directly
Merge pull request #2742 from dimagi/user-roles-perm

Fixes issue creating new user role