added token validation and role check