Comment 11 for bug 1606495

And I should mention, I tested this in devstack. Setting the policy to:

    "copy_from": "role:admin"

allowed my admin user to use copy-from with v1, whereas my demo user got a 403.