Hey Eric, a few observations..
This statement:
<cfif url.UserRoleID IS 3 or 1>
is not the same as
<cfif url.UserRoleID IS 3 or url.UserRoleID IS 1>
This statement will alway be entered, because the second criteria, which is simply "1" will always true
<cfif url.UserRoleID IS 3 or 1>
^^^ this is like saying "or TRUE" which is always true, like 1 = 1
So this CFIF will always be entered.