Allow adding roles to user without a tenant

Currently, in /users/userId/roleRefs a tenant must be provided:
{
  "roleRef":{
    "id":1,
    "roleId":"admin",
    "tenantId":"one"
  }
}

There must a way to add a role without a tenant:

{
  "roleRef":{
    "id":1,
    "roleId":"admin",
  }
}

Here is a proposed patch: https://github.com/aababilov/keystone/commit/9171a73a8646afffba0f8bea67530dbdea7c4428
It just allows to parse a roleRef without a tenantId