Don't always call `set-roles`

`wrap-role-headers` and `set-roles` is called for every network request. We could refactor so that roles are only sent if roles have actually chanved (e.g., store into session the roles and compare). This would reduce re-frame event spamming.