User roles, states and sessions