start for user with roles and permissions (see #260). not finished yet.