Auth and RBAC in multi-tenant React apps