Change access callback to check roles.