add support for inherit in revoke_roles
add test for locally revoke roles