user without roles inherit roles of previous user
This is caused by
Extensions.Users.userToAttr which assumes that non-existing map fields are removed in the underlying SDS
SDS.Sources.System.currentTaskInstanceAttributes, which is not the case.
currentTaskInstanceAttributes uses the union of the current and updated attributes.
As I don't have enough knowledge about the semantics of the attributes, I can't judge whether the behaviour of
currentTaskInstanceAttributes should be changed.
A workaround which seems to work is to use an empty string for "auth-roles" in
userToAttr in case there are no roles. If this workaround makes sense, we could use it and postpone a proper solution.