Allow with_role_sql to pass an object that responds to roles