Delegate 'authorization' to to extensions and remove @RolesAllowed from RestController so unauthenticated access is allowed