PLD: determine role from permissions and not users, closes #440