Implement ERRAI-732.

Restricted access can now require roles form a provider class at
runtime.
Add documentation for ERRAI-732.