has_acl check for multiple roles