BUGFIX: allowed_tree([<roles>]) must use Set.difference for correctness