security and roles (refs: #581)