Ensure roleId and principalId to be string in Role#isInRole

This fix is similar with issue #246, when roleId or principalId is a ObjectId, we won't get expected access control. The roleId in this context must be presence, so I just make type casting on it. Please check it.