add role 'app' by default