refactored rosters controller to authorize users better