use roles (userIs) to check if user is provisional user