replace restrict_access_to with Grape helpers