only require OAuth authentication with a list of allowed roles