Added config switch for filtering/passing through external claims
Added better version of IsInRole - which only uses roles from the internal issuer