That's probably a cleaner way to do it - when I was looking at how to remove the role-specific check, I forgot about the CIDR which will give us what we really desire.  As I'm at Hadoop Summit this week, I can't really test until I am home next week.  So, we could merge this PR and do a follow-up PR which switches the test over - or if Chris is comfortable, one of you two could push to the network-test branch after appropriate testing.  Either way is fine by me.