implements basic access control through Shiro