Add an enabled only for certain roles option

For role based permissions, the current option to disable by role is problematic. With role administrator for example, if one wants to disable the field for all other authenticated users except the administrator, selecting disable for authenticated user also disables for the administrator. This is shown as a @todo several times in the code: //@todo seems it's not the best way to check permission. What if user has several roles?

This is a simple solution that adds an option to enable the field only for certain roles. Patch attached.