Add role-based authorization

Closes #3.
Could `roleList` be renamed to `currentUserRoles`?