add role check code for controller