Dynamic user roles

Allow :roles to be a function, which will be executed with no args and assumed to return a collection of roles each time user authorizations are checked.

This allows, e.g., promoting a user to a new role without forcing a logout+login.

Closes #21.