fix permission checks for available roles

fixes CNVS-13848

test plan:
 * create a role that only has permission to create admins
 * in a subaccount, grant that role an additional permission
 * in the root account, add an admin to the role
 * log in as that admin
 * in both the root account and the subaccount, attempt to create
   an admin - it should only list your role in both cases

Change-Id: If9a2dd4952e432700c59a0d4ad5e76ffa822dd0f
Reviewed-on: https://gerrit.instructure.com/37408
QA-Review: Clare Strong <clare@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>