add "get user roles" method to API