Don't allow empty role set to be passed to wrap-authorize

I've added the check in wrap-authorize and written a single unit test to verify it's being thrown.

It might be necessary to add the check in the authorized? function instead. This would cover the case where an empty roles set is passed to the authorize macro, which could have the same effect as passing an empty role set to wrap-authorize.

For now, this would have to suffice.