added dump
fixed typo accessing Login state
added simple role middleware
removed auth type checking, default to local