password salt and user roles