role provides identifier
token should be converted to json before inclusion in the authorization header