changed security middleware to take roles into account