admin login is OK, next problem is how to maintain the role in session