Only users in roles (membership) can ask tokens