separate user roles from accesslevels