Role based API endpoint security

Fixes #5