added role authorization for users