Allow req.session.user.role to be an array of roles

Hi,

It would be nice to have either an array of roles or a single string in the req.session.user.role property, so you can handle multiples roles for a given user directly in the middleware.

The change is pretty straightforward and obviously backward compatible.

Thanks for your review.
/Jim