Disallow empty string roles

Having an empty role (empty string) looks like a terrible idea, but we do not prohibit it. I think we should add corresponding checks and update the docs to officially disallow empty roles.