added role checking in base controller