adding role check to api chain