Actually fix roles handling, with a test!