Roletickets

Has work for three role-related tickets, ENG-6818, ENG-7088, ENG-7237, in that order.

Each commit is self-contained for one ticket.

There are also test changes for pro, but they are non-functional.
Because it checks for two?
Yeah, I filed a ticket for that.  I also put a ranty comment in the place where we add default roles to the catalog.