keystone_user add role actions must be separate

Need to add a user with keystone_user: action first, then add a role to
that user. Can't do it all in a single call to keystone_user: action.