How to map a database USER to a database ROLE, then limit both to EXECUTE stored procedures only