bugfix: check user role