code: @Override
      public boolean isUserInRole(String inRole) {
          if (this.roles == null) {
              return this.request.isUserInRole(inRole);
          } else {
              return this.roles.contains(inRole);
          }
      }
docs: Checks if the given role is one of those that were passed into the
  constructor. If <code>null</code> passed in for roles, it checks
  the request that was passed into the constructor instead.
  
  @param inRole a role.
  @return <code>true</code> or <code>false</code>.