Restrict access based on user role