allow global roles (without site_id)