Steps to reproduce:

1. Create a user role assigned to some organizations and locations
2. Try to clone the role with either api or hammer

Cloning roles without any taxonomies work fine.

Actual results:
The API call fails on validation of the cloned record:

[ERROR 2017-03-09T14:11:07 API] 422 Unprocessable Entity
[DEBUG 2017-03-09T14:11:07 API] {
    "error" => {
                   "id" => nil,
               "errors" => {
                "locations" => [
                [0] "is invalid" 
            ],
            "organizations" => [
                [0] "is invalid" 
            ]
        },
        "full_messages" => [
            [0] "Locations is invalid",
            [1] "Organizations is invalid" 
        ]
    }
}

In fact the original validation error comes from taxonomies:

you cannot remove organizations that are used by hosts or inherited

Active record hides the message with a generic one for validation errors on associations.

Expected results:
The role should be successfully cloned with all taxonomies set.