The problem was being caused by using this...
if (Roles.IsUserInRole("Tenant"))
...instead of this:
if (Roles.IsUserInRole(model.UserName, "Tenant"))
The former can be called after a user is logged in. It seems the latter has to be used when called inside Login
- may have something to with the user not being in the session / fully logged in etc.
It works anyway.