Update rbac_definitions schema to be less restrictive about roles, refs #444