fix potential bug: user has unknown role