Use Spring Security's authorities instead of roles.

No functional changes.