has_role? can take an array of roles