WL-3603 Generate good SQL with no roles.

When there are no roles associated with a permission check we should still run the SQL correctly. The statement was failing because a bracket wasn’t closed when the roles were empty.