Roles of customer read from session object from DB now | WWW-Authenticate header will contain domain pointing to authentication serice