Access is restricted via not showing in the following places:

* hide from sidemenu
* hide from panel header menu
* disable keybinding `x`

Also adds a `roles` property to reactContainer routes that will be
checked if `roles` is set, and on failure redirects to `/`.