sending correct roles on api/auth