Move $user_roles assignment into AppController, set for every
default-layout page