use Flask-Principal for roles