Add parameter to disable roles

Also, make sure client provided roles are *not* send through