Role provider authorization

- Fixed, role provider ignoring current controller's authorization
attribute.