Hmm the schema looks right *I am looking in hg:website/issues/schema.py.

Pefu has both User an Developer roles.

# Users should be able to edit their own details -- this permission is
# limited to only the situation where the Viewed or Edited item is their
own.
def own_record(db, userid, itemid):
    '''Determine whether the userid matches the item being accessed.'''
    return userid == itemid
p = db.security.addPermission(name='View', klass='user', check=own_record,
    description="User is allowed to view their own user details")
for r in 'User', 'Developer', 'Coordinator':
    db.security.addPermissionToRole(r, p)
p = db.security.addPermission(name='Edit', klass='user', check=own_record,
    description="User is allowed to edit their own user details",
    properties=('username', 'password',
                'address', 'realname',
                'phone', 'organization',
                'alternate_addresses',
                'queries',
                'timezone')) # Note: 'roles' excluded - users should not
be able to edit their own roles.
for r in 'User', 'Developer':
    db.security.addPermissionToRole(r, p)

Bern, Ralf ideas?