add pre hook and permission check
allow optional required roles; allow early returning in Pre() hook