Use userRoles if availables instead of tokenRoles

should be private, then the declaration should be after public methods