User roles from groups are now aggregated when creating a security token