I would like users to only be able to have one role. Your sample app does that. Copying the code to my app, I get multiple roles per user. I can't see where your sample app stops there from being more than one users_roles record per user.
I figured it out - you can delete this.