Role inconsistencies

[Rutherther]

After student enrollment the relevant information takes time to propagate. That may not pose a problem, but some issues could be solved by making roles "dependant".

For example, if person gets programme role, it's certain that he is from FEE. But the user may not get FEE role as FEE role is obtained from usermap. programme role is "dependant" on FEE role. On the other hand, FEE role excludes the possibility of CTU impostor role.

If role X depends on Y, and the user has role X, add role Y.
If roles X and Y do not go together, and the user has both roles, remove the one with lower priority, or in case the priority is the same, choose the last one.

Roles will get their priority during the auth process. Dependent roles will get the same priority as the role they were derived from.

[Rutherther]

This problem may arise only few times a year, and handling adds potential for more errors, and would take time that may not be worth it.