Fix adding all roles for an application to token, should be all roles associated with the user for that application