fixed role checks