When the last role of a user is removed, the
audit_user_fields() auditor crashes, because the
newvalues key 'roles' is present but not a string.

Patch included :-)