separated REST roles from WebApi roles