SPRIN-1 Push roles of the user profile into the security context

Added a service to copy the roles to the spring authorities + use that service by default.
There 's no need to make the list unmodifiable: that happens in the constructor of ClientAuthenticationToken.super