assigning roles to user - RBAC