The 'rollback' permission now only affects whether rollback is made available through the interface. Users without the rollback permission can still use it by generating the proper token through a script. This does nothing but allow automated rollback scripts to generate less load on both the client and the server, without allowing them to do anything extra. This was inspired by an anti-vandal bot operator on enwiki who showed me his server load dropping in half when his bot switched from manual reverts to rollback.