Fix overzealous check of allowed keys on a role, removed the requirement for flask-login by moving a global import out of scope