title: ROLE_PREVIOUS_ADMIN always is_granted for ROLE_ADMIN
body: <p>I'm following the Symfony docs and using the following twig helper function to determine if a user is switching roles for impersonation. The problem is, it always returns true for ROLE_ADMIN.</p>
  
  <pre><code>{% if is_granted('ROLE_PREVIOUS_ADMIN') %}
      &lt;a href="{{ path('homepage', {'_switch_user': '_exit'}) }}"&gt;Exit impersonation&lt;/a&gt;
  {% endif %}
  </code></pre>
  
  <p>Oddly enough, when I inspect the security token via the debug toolbar for admins, I see the following roles: </p>
  
  <blockquote>
    <p>[ROLE_ADMIN, ROLE_SHAWMUT, ROLE_USER]</p>
  </blockquote>
  
  <p>And the following inherited:</p>
  
  <blockquote>
    <p>[ROLE_USER, ROLE_ALLOWED_TO_SWITCH]</p>
  </blockquote>
  
  <p>So why does is_granted('ROLE_PREVIOUS_ADMIN') return true if the above are the roles available to this security token?</p>
  
  <p>=====</p>
  
  <p>This is what I have to do to get this to work, which involves using the depreciated app.security.token variable:</p>
  
  <pre><code>            {% if is_granted('ROLE_PREVIOUS_ADMIN') %}
                  {% for role in app.security.token.roles %}
                      {% if role.role == 'ROLE_PREVIOUS_ADMIN' %}
                          &lt;span class="imp-designation"&gt;{impersonating}&lt;/span&gt;
                      {% endif %}
                  {% endfor %}
              {% endif %}
  </code></pre>
  
  <p>=====</p>
  
  <p>Here is my security.yml file: <a href="http://pastebin.com/f04ZG4K8" rel="nofollow">http://pastebin.com/f04ZG4K8</a></p>