For some reason, we ended up with some roles (as in user.roles JSON field) that have a "ROLE_" prefix, and others that don't, even for the same role (like ROLE_GLOBAL_ADMIN vs GLOBAL_ADMIN).
Clean this up by ensuring all roles in the user table are using the "ROLE_" prefix.