When calling AddUser to add a new user or modifying the roles array no verification is done that the role actually exists.

This allows for simple typos to cause unpredictable authorization behavior and potentially permission problems which are very difficult to troubleshoot. If the system allowed for custom defined roles the case would be even stronger.