Protected user roles route in api