Allow :roles to be a function returning a collection, which will be exceuted each time user authorizations are checked.

This allows, e.g., promoting a user to a new role without forcing a logout+login.

Closes #21.