Add role constraints for xen role
Merge pull request #294 from vuntz/fix-xen

Add role constraints for xen role