Check required_roles against user in Ability#can?