hide role implementation from webapp
get rid of global cancel status
refactor to enhance clarity
check if interceptor class is really a pre-/post interceptor, and trigger internal server error if not
do not throw RuntimeException, trigger internal server error instead
catch non-catched exceptions and turn them into internal server errors
add note about catched exceptions