It's useful to be able to constrain a method invocation to multiple roles instead of just one. DWR supports this, but the @Auth annotation does not. Patch attached changes the role attribute to be an array, which is backward compatible since users can still use the single-value syntax.