Managing User Roles via REST

I'm curious about the best way to handle user roles in the REST API, as I've had some interesting issues trying to manage that via the User endpoint.

When you create a new User record, any roles in the UserData.Roles construct appear to be ignored - I tried using both the RoleName and the RoleKey in that string collection, but ultimately after the user was created, neither method assigned them the roles.
Additionally, I've noted that you cannot PUT to User to update those roles (or update the User record at all). Nor can you POST an existing record to User to update it, as that results in a 500 error (Service Error: Failed to create user [username]: DuplicateProviderUserKey).

Based on this, it seems to me that the User endpoint can be used only to create the UserMain record, but cannot be used in any way to manage roles. Is that correct? Do we have to then use the UserRole endpoint to add/edit roles?

Thanks!