Add role-based authorization

Closes #3.
Could `list` here be renamed to `allRoles`?