permissions: implement _remove_role