[Zope] PluggableAuthService question about roles