Properly handle dynamic roles in allow_optional_tasks

We can't splat a lambda, so we need to check for it when we are
defining a default empty role list. This resolves #252