Check the capabilities of the Vault token to ensure it is valid and also
allow targetting of a role that the token is not from.