hook up global user roles & introduce "owner" role