basic user roles / client-only