correct handling of single role users