allow normal user to delegate Reader role only