Amend `Policy#match_roles` to fallback to `@user`