A simple implementation of the access control.
It assumes the user object has a getter called roles which returns
a collection of roles (Iterable<String>).
Each role is represented as a string.
For better performance, it is suggested to be Set<String>.
