state cookie, roles