switch to using roles for users