Allow on.roles single-string role values (not just all)
#26789
+41
−2
Merged