MDL-69093 enrol_manual: added check for allowed roles a user can assign