Replacing save() with the evil ajax because I can't get save() to work. If I add a serializer I lose the current user roles. Without the serializer the roles are never sent to the server.
Moved duplicated logic into a shared method.