routes.js now receives roles