add unauthorized response type
move permission checking to role checking
move vitali.provides to struct field tag
move consumes to struct tag