Add role-based authorization

Closes #3.
Here's a reference to the Customer model that should be removed at some point