added TODO

login needs to set the role somehow