The code implements PERMISSIVE, which is the default. Need a hook to turn on REJECTING, which should generate a role mapping exception if > 1 role is mapped.