asp.net Forms身份验证和基于角色的权限访问

            UserModel um = ValidUser(txtName.Text.Trim(),txtPassword.Text.Trim());
            if (um != null)
            {
             //创建身份验证票据
             FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,
                                            um.Name,
                                            DateTime.Now,
                                            DateTime.Now.AddMinutes(30),
                                            true,
                                            um.Roles,//用户所属的角色字符串
                                            FormsAuthentication.FormsCookiePath);
             //加密身份验证票据
             string hash = FormsAuthentication.Encrypt(ticket);
             //创建要发送到客户端的cookie
             HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hash);
             if (ticket.IsPersistent)
             {
                cookie.Expires = ticket.Expiration;