add role-based authentication