* feat: allow IDP to return single string instead of array for roles/groups claim This is to support ADFS