update roles remove allowDomain option

Signed-off-by: xiehuc <xiehuc@gmail.com>