Remove Role Mapping from Undertow

Instead of handling role mapping within Undertow the mapping should be provided by the IdentityManager implementation which is the integration point with the application server.

As the responsibility is moved the Account returned from the IdentityManager is now used to check role membership rather than group membership - i.e. the Account is now specific to the app being accessed.

See subsequent message for two related pull requests.