Users with "administer users" can assign arbitrary roles via bulk CAS user creation

Hervé Donnerrequested to merge
issue/cas-3620142:3620142-3.x into 3.x

Closes #3620142

Merge request reports