added example using role defaults vs. vars