role based security is enabled and working correctly