otherwise make extra sure the role is correct, though I don't think that gives authorization errors