Added client side showing of routes based on roles but apis still locked down for security