Plust logic of whole method would be great to improve.

It is called once per user - on create time, means - always we will have empty roles. If that is true maybe we should cleanup this to be more explicit?