Fix for User#roles

- redefined #roles= setter to disallow setting value to String
- added validation to check for correct roles