userData could contain roles or what not. Should be enough to do authorization based on the payload