For #465, Finer grained logging for role principal classes and role checking, probably need to support configuring multiple roles so we can look for GroupPrincipals