[support] Restrict access on user/* "by role"