Rep 963

This allows for using role as the tag within ignore-tenant-roles to be more consistent with Auth-N
This null check, and the one above it, will never return null. An empty list would be returned instead. I think these checks are unnecessary?