s4-provision permit server role to be the ROLE_ strings from s3