split out grant_roles.sql