PersistentRoleGroup can now delegate to any group

  * This is done by keeing the expression in a DML slot
Fixed usage of Person.hasRole