docs: private static String generateSignature(AuthToken token) {
          StringBuilder builder = new StringBuilder();
          builder.append(token.getPrincipal());
          builder.append("||"); //$NON-NLS-1$
          builder.append(token.getExpiresOn().getTime());
          builder.append("||"); //$NON-NLS-1$
          builder.append(token.getIssuedOn().getTime());
          builder.append("||"); //$NON-NLS-1$
          TreeSet<String> roles = new TreeSet<>(token.getRoles());
          boolean first = true;
          for (String role : roles) {
              if (first) {
                  first = false;
              } else {
                  builder.append(","); //$NON-NLS-1$
              }
              builder.append(role);
          }
          builder.append("||"); //$NON-NLS-1$
          builder.append(sharedSecretSource.getSharedSecret());
          return DigestUtils.sha256Hex(builder.toString());
      }