checking for role/identity before/after authentication