move updateUserRole to bellows project services
fix LexiconRoles permissions and use bellows project service updateUserRole