Pass only users with "local" role in 'chkAuth' combinator
Deny requests when the role check fails, not vice versa