apply roles for controllers, delete LoginController