Fix #1977 "FB user rejected if role matches but app is `*`"
Don't filter elements in no namespace, fix #1981