finished user roles, and updated loginUser() to return UID even if user is locked out