MDL-70320 permission overrides: role names were double-escaped