set_role_query is called inside application_controller