use actual activity table to determine role auth, refactor generic not-auth oout

--HG--
branch : noink