Add access control based on userrole and auth