Permissions from roles should be transitive

[horcsinbalint]

If someome can give out role B because they have role A, and role B can perform action C, then role A should be enough to perform action C. There are multiple instances of this problem. The exact scope of the issue needs to be investigated.