*isLoggedIn* method is never used and I don't get why do you need *setLoggedIn*. You are just making things easy to someone bypass your auth system. The same thing for *getRole*, if you know that "John" has the role admin, he will definitely be my possible target.