users can be added to / removed from roles