add #23

this is a minimal implementation of users / roles.

should I add anything else?