-small refactor
-secure user and userId with different roles