hasRole helper check role hierarchy