add user's roles to CAS token