1. A system for creating switchable virtual desktops each requiring a different user authorization comprising: a) at least one memory; b) an authentication and authorization (A&A) data store configured to store roles assigned to each user in said at least one memory; c) a virtual desktop manager including a desktop management agent and a virtual desktop application configured to provide a user interface to enable a user to manage said virtual desktops on a single user device and specify a role for each said virtual desktop, said virtual desktop manager configured to enable creating, switching, and destroying virtual desktops and to specify process tokens for each said virtual desktop, said process tokens defining different permissions with a single session, wherein the virtual desktop application launches when said user i) logs onto a computer, ii) creates a new virtual desktop, and requests a role for said new virtual desktop, and upon request by said user, initiates a switch from said new virtual desktop to another virtual desktop; wherein said A&A data store and virtual desktop manager operate cooperatively to generate a plurality of data structures stored in said at least one memory, each representing one of said virtual desktops, so that when said user requests said switch from a first virtual desktop to a second virtual desktop, each requiring a different user authorization, the user's authorization automatically changes to an authorization associated with said second virtual desktop without requiring the user to re-authenticate with said second virtual desktop, and wherein the desktop management agent is connected to the A&A data store to determine if the requested role is allowed, and i) when said requested role is determined to be allowed, the desktop management agent creates said new virtual desktop, a desktop object and an accompanying user shell process to implement the new virtual desktop, ii) when said role is determined to not be allowed, the desktop management agent causes the virtual desktop application to prompt the user to use a different role, wherein the desktop management agent is connected to an LSA module and is configured to intercept requests for process tokens when an operating system creates new processes.