The new rules that we need to conform to: A commit always saves 1 and only 1 object. A lookup always loads the requested object (if available) and may also load other objects for performance reasons. Basically, calling commit on the UserFactory should only commit the User, not the User's addresses or any other business object in the User. Calling addRole on a User should update the roles in the DB directly, not rely on calling commit to do so. This is the model we will follow everywhere.
This has been done now. This was done for two reasons: 1) To follow our proscribed model, and 2) for performance reasons.