user_access() fails when called before a valid global $user object is set

There are situations in which user_access can be called before a valid global $user object has been set. In these cases user_access fails while trying to run the query on line 368 with the following message:

# warning: array_keys() [function.array-keys]: The first argument should be an array in /drupal/modules/user/user.module on line 368.
# warning: implode() [function.implode]: Bad arguments. in /drupal/modules/user/user.module on line 368.
# user warning: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1 query: SELECT DISTINCT(p.perm) FROM role r INNER JOIN permission p ON p.rid = r.rid WHERE r.rid IN () in /drupal/includes/database.mysql.inc on line 172

As an example, I have created an external authentication process using hook_auth. When this function returns true, user_authenticate attempts to user_load the user's information using their name. If the user does not exist, the global user gets set to false and user_authenticate creates an array of user information and calls user_save('', $userinfo), which attempts to add them as a new user. At this point the following function chain happens:

user_save -> user_module_invoke('insert') -> profile_user -> profile_save_profile -> _profile_get_fields -> user_access

user_access then fails while trying to create its sql query, because it makes the assumption that the global $user is actually a valid object, and thus that $user->roles is actually a valid array.

My thinking is that user_access should check if $user->roles is actually an array before trying to execute its query, and the attached patch solves the problem that way (causing user_access to just return FALSE in this situation, which seems right.) However, I am also just getting my feet wet with the whole user/authentication system, and its possible there's a better answer so I'm open to ideas and happy to roll a patch for whatever is best.

Drupal 5.2, PHP 5.2.x, MySQL 5.x