feng - update with roles.has_only_roles?