Fix #1325: RbacSecurityUser doesn't handle users without roles properly