I want to make wcf authentication, by username and password. After that, to make custom attributes to services, to restrict access by username. For example if authenticated username is User to restrict access to delete, if moderator to allow. How to do that, and what are the best practices?