Set roles for a user

Replaces all role grants for the specified user with the provided set of roles. Requires ORG_ADMIN role.