WIP: User managemet

replace ```(allowed? ...)``` with ```(has-admin? roles)```