I noticed one of the roles they were "testing" with was missing the "web services", so I've added that. Also, they may have locked themselves out... so at this point I'm not sure what the issue is. Trying all over again.