Pulls out common logic from decorator and mixin, and adds check for configuration

Does it make sense to add another test around this if/else logic, where the allowed_roles parameter is set to a string (i.e., single role like "Instructor") instead of a list or tuple?