discovered the `rd token create` -r optarg needs roles as comma sep not space sep as the subcommand's help output indicates