default role set to 'login' when not logged in