update_roles now associates ApiUsers.