Fix/use permitted params for role

see: https://www.openproject.org/work_packages/3333

use permitted params for the role model.