Role-based access · sessions expire on logout