Require proper roles in API endpoints