Implement support for TAP 3: Multi-role delegations

[joshuagl]

(NOTE: this issue is copied from docs/ROADMAP.md)

Description of issue or feature request:

TAP 3: Multi-role delegations is an Accepted TAP but not implemented in the reference implementation.

Current behavior:

Multi-role delegations are not supported

Expected behavior:

Multi-role delegations, as described in TAP 3, are supported

[joshuagl]

NOTE: progress on this issue is blocked by the refactor, specifically #660