Fix an off-by-one in role names