token is now containing attributes and role