Use userRoles if availables instead of tokenRoles