Activating/deactivating roles on the fly in a login session

[Nicklas Nordborg]

A user with multiple roles should be able to select which roles should be active during a session. For example, a user that is also an "Administrator" might want to disable the "Administrator" role until it is needed.

Which roles should be active after logging in? There are a number of possible options:

1. It is automatically remembered per user.
2. A configuration option for each role that forces a role to be either active or not.
3. A combination of 1 and 2. Some roles are forced, some are remembered.
4. As 3 but each user is allowed to configure which roles that should be active or not.

To preserve backwards compatibility, lack of configuration settings must mean that all roles are active.