Fixed roles(...) - it wasn't adding to the list of authorities

Local:
List&lt;GrantedAuthority&gt; authorities
was hiding the member variable by the same name. This method was doing nothing with this local List.