#467 validate user roles on add/update

Resolves #467