fix array claims from JWT, add map for roles