user session ok, roles ok