Using users instead of roles as DB verification