Right now I decorate a method like this to allow \"members\" to access my controller action
[Authorize(Roles=\"members\")]
How do I
Another option is to use a single authorize filter as you posted but remove the inner quotations.
[Authorize(Roles="members,admin")]