Assign Api role on restricted user login