Enforce server-scoped role grants

Role granted on one server now applies only to that server; team-wide grants and server-scoped grants both supported.