make website the default role for auth middleware