Passing 'admin' as literal roleid was wrong - rolepermission.roleid must
reference role.id. Special roles (any/anonymous/logined) keep literal id
(hardcoded in rbac userperm.py); other names resolve via role table with
default orgtypeid='*', support 'orgtypeid.name' form.