Login update revamped

Hi Luke, here comes my suggestion:

* I removed default credentials and roles during the application initialization. If the developer wants to register a user, she must to enrol
* The annotation protecting the Enroll endpoint doesn't make too much sense into this scenario. Because how our users can register? If we want the feature of password reset at the first login, we can develop it on agsec
* I also replace enum by constants, make it more readable

Anything into this PR is far from perfect and are just suggestions.