starting to add roles and declarative authorization
adding and removing of users to roles