fixes #9: Application now only allows users with :access role