caters authorization for multiple user roles