Allow req.session.user.role to be either an array of roles or a string representing a role