enforce a user's role