AT:
- collection role entries contain User/GroupDto's with metadata as name, email etc. if available
- the collection index will still store the id only, the metadata is resolved during mapping using the identityService api
- the api changes are documented