make user provider able to return multiple roles