To support the extraction of useful information such as role and group membership (and more) from a bearer token, we should provide a read-only IdentityStore implementation that can process tokens and be used to query the user's relationships etc. This identity store (BearerTokenIdentityStore?) must be highly customizable in order to support many different token types.