limit roles to four per user