Fix use of User::hasRole() in transfer()