Expected: User without "Update roles" permission can not update role settings. Actual: User without "Update roles" permission can update role settings.