Added role-checking to backend (modify/add)