roles into controllers

not yet tested