added connect-roles to handle authorization