copy of keystone session management with roles