critical fix for role management, was using current_user instead of user