TODO (1h): automatically create a Notification entry for each user per role, and show an add/remove link here