add staffRestricted to authorizeRoute and set to true for staff related routes