Allow any app roles on signin