The change from 'update' to 'submit' successfully forced the role/expiration addition! So that's progress. The downside is that for every user I've applied updated, every other role they had were removed entirely.

That's good enough for my purposes right now, but anyone looking for this functionality should be warned that simply changing 'update' to 'submit' on line 146 may have serious consequences.