[development] How do I restrict the custom urls to a specific role?