+ add role_mask to users