In server-side security interceptor, only use roles from annotations of concrete type and interface that the invoked method is from.