rolemap.xml does need a <permissions> tag