This code was fine for the 0009 migrations since we introduced all roles
at once, however with changes in 0017 we can't just patch from the
roots, so this works generically without having to get fancy about
identifying which roles we need to actually update.