Move auth rules to pe_role

It seems to make more sense to declare them here since they're directly
about tieing different hosts together