1. hasing passwords was moved to model
2. there is no need to detach() role, because of foreign keys and onCascade DB relation