use auth instead of roles