basic implementation for HttpRequestImpl#isUserInRole