Optimize the org roles lookup a bit around 'denied' roles.