the `has_role?` method or the whole `NullUser`?