Be careful about case here. If the "operation-headers" -> "roles" is used we can't guarantee case. I've had to fix bugs due to that elsewhere by converting the input to upper case before doing map lookups. Unfortunately you have the opposite case here, where the Set contains the non-canonical value.

We could count on the RoleMapper providing the StandardRole strings in their StandardRole.toString() form (which I believe they do.) That might be sufficient here, so this comment is mostly an FYI. 

We could also make it part of the RoleMapper API that the strings be all upper case, but that sounds hacky. I don't want to force the RoleMapper to return things in the exact form of whatever name the user gave a scoped role, as that will complicate matters for the RoleMapper a fair bit. It's possible other stuff we will have to do though will make it an option. In that case what you have here would be perfectly safe, as the RoleMapper API would mandate it.