security against users with no role