Use the role hierarchy to get user roles.

Fix for issue #282
Add test cases for AclHelpers