users can only have one role - ROLE_ADMIN inherits ROLE_USER abilities