back out r8124
r8124 shows ":roles can't be empty".
Authored by: tmaruyama 2011-12-08
Parent: [r8124]
Child: [r8126]
