Module should not directly manipulate users_roles table

The module should use user_save() or similar mechanism to update the user's roles. Currently it is directly manipulating the database. This means that other modules cannot act on role changes, because they never get notified. Role Change Notify for example, can't send out role change notification messages. Workflow can't take action, etc.

Attached is a patch that uses user_save() to do the change to roles both on approve and deny.