added pending account role to restrict access to unapproved accounts