fix roles security issue