added: roles will be extracted from token-create call