checking for user roles in jsp 2