added support for specifying a tenant-specific role to new users