Right yeah, and the prefix would have to be checked at issue-time anyway, which should come from the authz layer itself, at which point it's not adding much value having it in the token I guess, if everything goes through the proxy anyway