Consolidate config checks and simplify role application.

[gwsii]

Thanks to @erikerikson great feedback on the initial implementation.

These changes push the configuration validation code to the start of the plugin invocation. Also reduces the code to apply the policies to the roles.