Make auth roles optional, take 2