Simplify match_roles to only use instance variable and rename to matching_roles.
Add explicit spec for testing the order of roles.
Do not sort roles as they are already in the correct order forced by DSL.