don't set roles via metadata in backend api

In the testing code we use update_metadata to configure roles:

        self.metadata_foobar = self.identity_api.update_metadata(
            self.user_foo['id'], self.tenant_bar['id'],
            dict(roles=['keystone_admin'], is_admin='1'))

I think that roles should be a separate (first order concept) from metadata

When implementing a backend, you shouldn't have to examine the metadata to determine if you also need to update metadata.