making ShiroAuthenticatorOrAuthorizor#getRoles protected...

... to enable possible overriding by custom impls