* @param mc the {@link MessageContext}
* @return the list of roles of the logged in user or resource owner
* @throws WebApplicationException with Status 401 if not authenticated
*/
public static List<String> resolveUserRoles(final MessageContext mc) {
final OAuthContext oauth = getContext(mc);
return oauth.getSubject().getRoles();
}