[Sprint: 40] XD-2122: Use roles for security access

Chose to leave ROLE_ADMIN for pure management access. CRUD access is ROLE_CREATE and simple R access is named ROLE_VIEW
Yes. There are a few different ways to handle role composition, but that's a discussion for another medium, I believe.