[#2]: Restrict URLs based on roles