rbac: pass users credentials to API calls

Signed-off-by: Pierre-Alexandre Meyer <pierre@mouraf.org>