adding support for security roles (instead of too many flags)