@dmitchell where was the comment/docs you added to warn callers that the method does not actually check if the user has the role?