set up auth filtering of non-CMS roles