One goal of the Roles change was to isolate the rest of the code from knowledge about how the Roles are managed. Instead of peeking at the groups, can these tests just use the role objects?