always include the full "roles" details when requesting /users/me