Seems odd to me that all of these "role for user" methods are on the `Tenant`. Could we put them on the User and have them require a `Tenant` as necessary?