Change the query used to check if a user has a capability but is assigned a role that prohibits that capability. This is based on the query added by Petr Skoda for MDL-57027.