added roles and a basic authorization framework