expressjs and protected routes with user roles - Kinde