a user has access in live but no access in sandbox - yet, sandbox role is available when he logs on. how is this possible?