is there any way to protect routes like router.get('/nuts/download/win', auth.hasRole(['cashier']));