added flask-login setup, decorators to restrict access based on user_role