use user.roles to determine whether user is service provider