Hiding Recalibrate when user.role !== "director" does not lock POST /api/v2/satellites/{id}/recalibrate. An observer session token still gets 200 OK.