Make roles embedded within the user collection. Other changes - probably half-baked - just need to commit and then get onto my desktop computer.