users have 'roles' (with multiple domains)