use the roles in the token when recreating

Change-Id: I98e1b71d5b7de7867945294ebd569efd2cd7314b