protected attributes can really hold a __roles__ list. Also, subclasses
often want to set up different protection for inherited attributes, in
which case either a copy of the DTMLFile is needed or the roles have to
be stored separately.