- Sync with Python version.  Notably, move check of user's roles *below*
   the test of ownership and proxy roles, which makes the error handling
   *much* cleaner.

 - In the case that we have a stack, but the top *doesn't* have proxy roles,
   fall back to the user roles.

 - In the case that we have a stack, and the top *does* have proxy roles,
   skip checking the user roles altogether (proxy rolse replace user roles).