title: Update/change roles claim (or any other claim) in JWT
body: <p>I'm storing user roles inside a JWT (to restrict API endpoints). The roles can be changed by an administrator.</p>
  
  <p>If a role is changed. How am I supposed to reflect this inside all tokens? I've thought about a couple of solutions:</p>
  
  <ul>
  <li><p>If I'd use refresh tokens, the user would have to wait until the expiration date of the access token is expired.</p></li>
  <li><p>I could keep a record of changed user IDs and check every request, and then return a new token if the user has been changed.</p></li>
  </ul>
  
  <p>Is there a standard way to do this?</p>