delegate token creation to user instance, this allows specified user implementation to overwrite how the token is created
store user and roles directly in their providers so that injection works even if no session caching enabled