applying role (permission template) is really slow

Fixes #660 and #697.