implemented authentication based on basic auth header; service is annotated with roles to allow