1) Persist additional data about user accounts (and their permission levels).
2) Create a new role, ROLE_ADMIN
3) Map /app/*.do to ROLE_USER, and /admin/*.do to ROLE_ADMIN