add role restriction to calendar