Fixed a bug in client auth, now based on role instead of user.id