fix log message
use path-based id for role; use :account/resources root for resources