use permitted params for role
enable moving roles in the list
add changelog entry
seems that the role params can be omitted when creating a role. restore that behaviour
leaner and cleaner `role?` implementation