405535 implement Request.isUserInRole(role) check security-role-refs defaulting to security-role if no matching ref