validate user role in controller