Authorizing users by their role