create a users model defined by different roles
user authorization works
user login/logout