@GET
@Path("/{username}/roles")
@Produces(MediaType.APPLICATION_JSON)
public List<Role> getUserRoles(@PathParam("username")
@Verify(User.class) String username) {
User myUser = userService.findByLogin(username);
List<Role> roles = new LinkedList<Role>();
Set<User> s = new HashSet<User>();
s.add(myUser);
for (Role r : myUser.getRoles()) {
// Copy onto a detached role object so we can omit users list, which could
// technically leak information here.
Role copy = new Role(r.getName());
copy.setId(r.getId());
copy.setPermissions(r.getPermissions());