First pass of role based authorization
More complete implementation of role granting