@Override
    public BearerTokenCredentialsBean generateToken(HttpServletRequest request) {
        BearerTokenCredentialsBean bean = new BearerTokenCredentialsBean();
        
        String principal = request.getRemoteUser();
        // TODO create platform specific subclasses of this to get the roles properly
        Set<String> roles = new HashSet<>();
        roles.add("apiuser"); //$NON-NLS-1$
        if (request.isUserInRole("apiadmin")) { //$NON-NLS-1$
            roles.add("apiadmin"); //$NON-NLS-1$
        }
        String token = AuthTokenUtil.produceToken(principal, roles, TEN_MINUTES);
        bean.setToken(token);
        bean.setRefreshPeriod(NINE_MINUTES);
        return bean;
    }
@see io.apiman.manager.ui.server.auth.ITokenGenerator#generateToken(javax.servlet.http.HttpServletRequest)
manager/ui/war/src/main/java/io/apiman/manager/ui/server/auth/AuthTokenGenerator.java