Use userRoles if availables instead of tokenRoles

Hm, the SDK should not require `symfony/security`. But you can require-dev for your tests.