[RFR] Use user's roles if user is an instance of UserInterface instead of token's roles