Bug 22895

I think the user should be able to specify a comma-separated list of roles 
instead of a single role like this:

<req:isUserInRole role="role1,admin">
  The remote user is in role "role1" or in role "admin".
</req:isUserInRole>
<req:isUserInRole role="role1,admin" value="false">
  The remote user is neither in role "role1" nor in role "admin".
</req:isUserInRole>

There currently really is no clean way to do a check like this.  The attached 
patches add this capability and also update the documentation (or at least the 
documentation I could find).

I also considered that a more complex syntax with parantheses, and operators 
for AND, OR, and NOT could be useful, but decided they weren't really 
necessary.  NOT can be simulated using the value="" attribute, and AND can be 
simulated by nesting multiple <req:isUserInRole> tags within each-other.  I 
also think a mini expression language like this would be overkill for this tag 
which is currently very simple.