Move rax:roles header checks above URI checks.