hook up authentication policy callback to use global roles
introduce "owner" role