Changing authorize attribute to support roles or usernames

This allows the implementer to permit a role without needing to have an explicit list of usernames accompanying the role.