Rep 963

This allows for using role as the tag within ignore-tenant-roles to be more consistent with Auth-N