- register as security listener
- use user roles