role based access - with removal of gaeuser datastore