Centralize roles_for call onto a new Base class, add controller mixin tests