Cached permissions now refresh from `/users/me?include=roles` after access token rotation