Amend `Policy#match_roles`

Allow fallback to `@user`