- more security roles
- ExceptionMapper not working in CXF, back to Interceptor