should this argument not be optional, and the provider skip providing roles on routes where the context is not available? otherwise the whole site must be under a firewall in order for this to work.