FIX EZP-23121: assignRole allows duplicate role/limitation assignments