only return roles and subb roles of session user