Authentication check based on user role, not OAuth provider