it's needed because you can apply role-based authorization with annotation AuthorizeInvocation. User roles are retrieved using interface IRoleCheckingStrategy from auth-roles module