userobj should not overwrite data.roles for existing user