add roles, correct auth