limiting endpoints by user role