SPRIN-1 Push roles of the user profile into the security context

Added a service to copy the roles to the spring authorities + use that service by default.
There 's no need to make the list unmodifiable: that happens in the constructor of ClientAuthenticationToken.super
Please don't make the class ```final``` so that new user details service can be based on it to retrieve by default the roles of the user profile.