Make auth roles optional, but still define reader role