add role and permissions to web user api + tests