Per-Request static data in ASP.NET
That looks safe enough at a quick glance. HttpContext.Current.Items is a per-HTTP request cache. Another option to consider to further reduce database calls would be to use session state.
Consider a scenario where you have a page with a lot of ajax stuff going on. Each ajax request will invoke a database call to load security roles, since they are all separate HTTP requests.
It will cache it per request, since you are using the current HttpContext.
If you were using a static member, it would be cached till the web application was recycled.
As such it looks fine - a fairly common pattern in fact (using a static member as an in-memory cache or the current HttpContext).