use simple role-based authorization instead of Pundit