Protecting Your APIs with Role-based Access Controls