I'm seeing this error "User 'root' denied access - missing required capability: 'cli-route'" (on the console) at the cutover stage of vFiler migration under 8.1 GA

The vFiler migrations are successful, but this error is troubling for production vFiler migrations which require zero downtime.
I opened a netapp support case and posted more details here:

https://communities.netapp.com/message/80796

I'm looking to confirm the proper useradmin user->group->role mappings for root in case 8.1GA introduced some bug.

I have (note no groups for root user - should I create a root group and add the mapping to the root role?):

useradmin user list
Name: root
Info: Default system administrator.
Rid: 0
Groups:

--
useradmin group list
Name: Administrators                  
Info: Members can fully administer the filer
Rid: 544
Roles: admin

Name: Backup Operators                
Info: Members can bypass file security to backup files
Rid: 551
Roles: backup,none

Name: Compliance Administrators       
Info: Members can perform compliance operations
Rid: 131072
Roles: compliance

Name: Guests                          
Info: Users granted Guest Access
Rid: 546
Roles: none

Name: ndmp                            
Info: 
Rid: 131077
Roles: ndmp_role

Name: oragroup                        
Info: 
Rid: 131075
Roles: oracle

Name: Power Users                     
Info: Members that can share directories
Rid: 547
Roles: power

Name: Replicators                     
Info: not supported
Rid: 552
Roles: none

Name: Users                           
Info: Ordinary Users
Rid: 545
Roles: audit

--
useradmin role list 
Name:    admin                           
Info:                                    
Allowed Capabilities: login-*,cli-*,api-*,security-*

Name:    audit                           
Info:                                    
Allowed Capabilities: api-snmp-get,api-snmp-get-next

Name:    backup                          
Info:    Default role for NDMP privileges.
Allowed Capabilities: login-ndmp

Name:    compliance                      
Info:    Default role for compliance privileges.
Allowed Capabilities: cli-cifs*,cli-exportfs*,cli-nfs*,cli-useradmin*,api-cifs-*,api-nfs-*,login-telnet,login-http-admin,login-rsh,login-ssh,api-system-api-*,cli-snaplock*,api-snaplock-*,api-file-*,compliance-*

Name:    ndmp_role                       
Info:                                    
Allowed Capabilities: login-ndmp

Name:    none                            
Info:                                    
Allowed Capabilities: 

Name:    oracle                          
Info:                                    
Allowed Capabilities: login-ssh,cli-snap*

Name:    power                           
Info:                                    
Allowed Capabilities: cli-cifs*,cli-exportfs*,cli-nfs*,cli-useradmin*,api-cifs-*,api-nfs-*,login-telnet,login-http-admin,login-rsh,login-ssh

Name:    root                            
Info:                                    
Allowed Capabilities: *




thanks