Add tests and use user_access for the role checker.