SWA + Azure Container app. Custom roles management

**Describe the bug**

A clear and concise description of what the bug is.
I'm using aad custom authentication. I'm hosting the backend api on a azure container app. The role management endpoint (the one pointed by the rolesSource config setting in the auth portion) is hosted there too.
Following the example I expected to find the user and the access token (with ms graph audience) in the body of the request. I always receive requests with empty body and the following headers
'x-ms-auth-token', Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjVGNTg2NTM1NEQ0....'
'X-MS-CLIENT-PRINCIPAL-ID', 'anonymous',
'X-MS-CLIENT-PRINCIPAL-IDP', 'azureStaticWebApps',

The bearer token has as audience the container app (instead of ms graph, the one I'd need to call ms graph to get group memberships as in the tutorial).
I tried with both v1 and v2 aad configs. Same result.

**To Reproduce**
Steps to reproduce the behavior:
1. host the backend in the container app
2. expose an api in the container app to manage the roles (getRoles)
3. point the rolesSource to that endpoint
4. login against aad
5. the request body is empty and the bearer token has the azure container app as aud

staticwebappconfig.json
`{
"navigationFallback": {
"rewrite": "/index.html"
},
"auth": {
"rolesSource": "/api/getroles",
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com//v2.0",
"clientIdSettingName": "AZURE_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET"
},
"login": {
"loginParameters": [
"scope=openid profile email https://graph.microsoft.com/User.Read"
]
}
}
}
},
"globalHeaders": {
"Cache-Control": "no-cache"
},
"routes": [
{
"route": "/api/albums*",
"allowedRoles": ["admin"]
},
{
"route": "/api/alberto*",
"allowedRoles": ["reader"]
},
{
"route": "/api/testdeploy*",
"allowedRoles": ["editor"]
},
{
"route": "/logout",
"redirect": "/.auth/logout",
"allowedRoles": ["anonymous", "authenticated"]
},
{
"route": "*",
"allowedRoles": ["authenticated"]
}

],
"responseOverrides": {
"401": {
"statusCode": 302,
"redirect": "/.auth/login/aad"
}
}
}`

swa repo
https://github.com/ariggi-epam/my-first-static-web-app

aca repo
https://github.com/ariggi-epam/containerapps-albumapi-javascript

**Expected behavior**
Get the user access token in the request body

What am I missing?