Minor refactoring on action processing.
Adds authentication requirements for custom user roles.

Currently only works with full URL specifications,
since it's handled before the action router quicks in.