* user.role['resource'] --> legacy
* More robust signup logic