RESTful user-role routes