Use roles to simplify permission checks for customer users

[ankush]

User has no role at all, which requires some extra checks which would otherwise be handled by framework