I just finished banging my head against trying to give a user
multiple roles.  Weird things kept happening.  I finally tracked
it down to the fact that I was entering "User, Staff", and the roles
parsing code was seeing that second role as " Staff" and not finding
it.

Ideally, an undeclared role should raise an error.  But the role
parsing code should also strip the tokens before it compares them.