user roles are now exlusive - a user can only have one role