More work on user roles, still incomplete