ClientState protected resources should include those from rolemapper