Add roles in authorization token #56
Description
Who can call our APIs?
- a logged in user
- a non-logged in user
- another app
A token, which is already implemented can differentiate between the first 2 types, but not the third type. If we were to introduce cross-app communication, we might need to add roles in the token to differentiate between type 2 and 3