add role-based access control to each view

plus some front end modify