@marianitadn: your code changed the logic of how default role is added, not sure if there are consequences, but I also didn't see a reason for that. 

Atm roles are not hierarchical (don't know if there any plans for this), so by removing a role, you remove permissions (and filters) associated with it.

Re: after_save vs. after_create: I continued with @thomasmckay's logic -- if an admin deletes a role it should stay removed. If this is a behaviour we want, then model should prevent from deleting the last role a user has, no matter what the role is.