users api and requiresRole middleware