Don't bug out if can't update roles for user

based on perms, or missing data field

tailbone/views/users.py

@@ -290,6 +290,11 @@ class UsersView(PrincipalMasterView):
         return user
 
     def update_roles(self, user, data):
+        if not self.has_perm('edit_roles'):
+            return
+        if 'roles' not in data:
+            return
+
         old_roles = set([r.uuid for r in user.roles])
         new_roles = data['roles']
         admin = administrator_role(self.Session())