Check press roles in protected endpoints

Checks press roles in the protected decorator and write-access check, so a member whose role lacks a release group can no longer deploy through bench.deploy_and_update or other protected endpoints. Teams without roles keep full access.