moves access denied path and role validation into app controller